All the gateway sees is the custom protocol that encapsulates the user’s web request. The gateway doesn’t see the browser-to-local proxy traffic, because it never hits the network. Web requests are then tunneled through the proxy program to an accompanying proxy server using a custom protocol, which is typically encrypted. Then they configure the browser to use the local proxy by changing its proxy server settings to something in the form localhost:port, like 127.0.0.1:9666 (see the discussion of open proxies below to get an explanation of the browser’s proxy server settings). Typically, these programs create a local proxy server on a non-standard port.
(Note to students and employees looking for circumvention tips: I’m only going to reference proxy types that 8e6 already blocks, so don’t break company or school rules by using this stuff, you will get caught.) Examples include XeroBank (aka TorPark, aka “Firefox on a stick”), Google Web Accelerator and McAfee’s Anonymizer. Many of these programs are “green software”, which means they don’t require any installation or elevated privileges, so they can be run from a USB thumb drive by a user with limited privileges. These are programs that users can download and run on their computers. There are basically five types of proxies: In this post, I’m going to focus on the what and the how. I’m going to assume you already know why they need to be blocked. If you’re not familiar with the issues surrounding proxies, this whitepaper is a good place to start. Well when it comes to your web filter and secure web gateway, the primary circumvention method your users are going to use is proxies. How will my users circumvent the security infrastructure of my network, inadvertently or otherwise? Some are external threats: How does malware propagate? What techniques does spam email use to evade detection? Some are internal threats: Which of my employees has access to sensitive data? Which programs are my users installing and using to get their jobs done, how do those tools work, and how do I secure them? And of course …
If you are an IT administrator charged with the task of securing your network, the most important knowledge you possess is an in-depth understanding of the threats you’re working to counter. Keep your friends close, and your enemies closer.
Reply Overview of the different types of proxies that exist - and how we block them How can I keep users from bypassing the filter using web proxies or "anonymizers"?
0 kommentar(er)
