blocking web proxies

Doug.Baggett · 2006-05-23T20:34:03+00:00

I've seen all sorts of people proclaiming that it's impossible to blockpeople from using external web proxies to sites (like myspace) withoutblocking the whole internet.Why could'nt you...1. Require everybody on your internal network to use YOUR authenticatedproxy.2. Block ALL encrypted outgoing activity by default through the proxy(except for authorized individuals). This is to keep somebody fromsetting up squid at home through a broadband connection and connectingto it via SSL or some other encryption. Basically if your sniffer doesnot recognize/can't decipher the traffic...block it.3. Sniff packets at your proxy for your blocked sites (like myspace)and deny them outbound access.This way anybody trying to access myspace through a public or privateexternal proxy would be stopped cold. Even if they successfully connectunencrypted to a public proxy your sniffer should be able to sniff the"" address from the packets and keep it from going through.Plus you'd have their userid and IPaddress on the inside (so you candrop an anvil on them!). In addition things like SSH would get blocked(due to encryption) so no forward or reverse port forwarding/layer 2vpn would work.Are there holes in my Evil(TM) network admin setup? :)

May 23, 2006 21 Replies

Rate this thread:

Sebastian Gottschalk 20 years ago

Wrong. The only need is an alternative socket library and a library-load call, the latter one not being needed on Windows if the admin didn't set the SafeDLLSearch GPO.

Vote

Volker Birk 20 years ago

Sorry, I will not spread links to Script-Kiddie-Toolz.

What? A tunnel? IBTD!

Yours, VB.

Vote

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required