torpark

[Face-Man]

I found out about this from the BBC and does allow filter free browsing from a usb stick, home drive etc. I just another thing to block.. 8O

 

Torpark

 

BBC- Free anonymising browser debuts

[webman]

As long as kids can't run EXEs from their Documents area or USB drives it shouldn't be a problem.

[Geoff]

Tor usually tries to connect out on a random TCP port. Hopefully most peoples firewalls will block this. However you can set it to use HTTPS.

 

The following rules in the snort 'snortfire' community package will catch Tor traffic:

 

100000874 - COMMUNITY MISC DLR-TOR Directory server response (community-misc.rules)

100000875 - COMMUNITY MISC DLR-TOR Client Traffic (community-misc.rules)

[IanB]

We support a number of sites, not all of which can be restricted by software policies (Peer networks etc. ).

I've been looking at network blocking:- It seems to set up connections though TCP 80 to a random address and then use TCP 9001 and/or 9050 to communicate. I will try getting those ports blocked by our network bods and see what happens. Will post here if I get any more info.

[woody]

As long as kids can't run EXEs from their Documents area or USB drives it shouldn't be a problem.

 

I'm concerned about this. How can you stop EXEs from running in My Documents and USB drives? GPO?

[Geoff]

It's been discussed previously, see these threads for a few ideas:

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=3279

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=1740

[StewartKnight]

I would have thought that kids wouldn't be able to do this unless the knew the proxy details

 

See.... security through obscurity does work!!!

[woody]

Looking at the other threads on how to ban exe files from usb drives etc (thanks for pointer Geoff), I will be trying Trust-No-EXE. http://www.beyondlogic.org/solutions/trust-no-exe/trust-no-exe.htm

[webman]

Yes, our (RM CC3) pupil usertypes cannot run EXEs from My Docs or removable disks (and other network places) due to GPO restrictions.

[Geoff]

I would have thought that kids wouldn't be able to do this unless the knew the proxy details

 

See.... security through obscurity does work!!!

 

Ok, just off the top of my head without getting too sneaky.

 

Method 1

 

1) Go to sysinternals

2) Download TCPView from the networking section

3) Run it straight from the zip file.

4) surf a few web sites to open some connections to the proxy.

5) Observe the IP/port firefox/IE is talking to.

 

Method 2

 

1) obtain a command prompt by your favorite method

2) run task manager ('start taskmgr') and find IE/Firefox's process id.

3) Surf some websites to open some connections to the proxy.

4) run 'netstat -o'

5) Observe the IP/Port of the process id you just noted is talking to.

 

Method 3 (Firefox Only)

 

1) enter about:config into the url bar

2) enter 'proxy.http' as the filter.

 

Method 4 (IE Only)

 

1) Obtain a command prompt by your favorite method.

2) enter the following command line:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings /s

 

Or

 

1) Browse the above key with regedit.

[IanB]

Torpark uses Firefox portable, so the IE stuff isn't relevant. This also means that you won't be able to control it by changing Firefox settings.

It also runs its own proxy- you will find that the IP address of the proxy Firefox connects to is 127.0.01. It is the outbound connection from this proxy that you need to block, and I have found so far that the destination address is different every time Torpark runs. Torpark seems to configure itself on the fly to use a different destination proxy each time- the users don't have to do anything except run it. Dangerous. :angry1:

BTW, I find cports.exe is a good utility to use to trace network connections. If I find where I got it from, I'll let you know.

[plexer]

Geoff was saying how pupils may find out the existing http proxy that is in use in order to put it in the tor settings files as they will need that to make outbound connections to the tor servers.

 

Ben

[tom_newton]

We (SmoothWall) are looking into ways of blocking torpark. These will hopefully be pretty general - folks use our proxy behind other people's firewalls sometimes - and with a bit of luck, my colleague Phil should have all the details for his talk at the edugeek conference. Naturally his notes will be made available on our website afterwards.

 

It looks like it is going to be quite a difficult job tho, and will certainly involve some firewall jiggery pokery.

[woody]

I have tried putting the proxy for our CLEO proxy here in Cumbria into the torrc file and I still can't get through. That's a very good thing.

[Geoff]

You could detect it with the snort rules I mentioned earlier. Combine that with an output plugin to add per ip firewall rules to the proxy box. Job done.

 

Of course if your using a whitelist for HTTPS then that'll mitigate it too.

 

 

I have tried putting the proxy for our CLEO proxy here in Cumbria into the torrc file and I still can't get through. That's a very good thing.

 

It does work, however:

 

1. you need to use the HTTPS proxy

2. you need to connect to a tor server running on port 443 (https).

 

There's various other ways of shoehorning it too. Like using a SSH tunnel as I have previously mentioned.

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=41897#41897

[tom_newton]

Geoff: might look at continually downloading a list of tor servers and banning them in the http proxy - but that would involve denying other ports that aren't proxied.

[woody]

It does work, however:

 

1. you need to use the HTTPS proxy

2. you need to connect to a tor server running on port 443 (https).

 

How do I set these to test then? Probably better to PM me rather than tell the whole CLEO community

[Geoff]

Geoff: might look at continually downloading a list of tor servers and banning them in the http proxy - but that would involve denying other ports that aren't proxied.

 

Well, I don't have that problem. There's no direct access out other than via the proxy server. ie, IP forwarding is disabled on the proxy.

 

Anyway, I prefer my dynamic blackholing using snort method. Your list might be out of date and your burdening the firewall with IP block's that'll never be hit. Worse still you might blackhole legitimate server because it's also running Tor.

 

In short, blacklists suck.

 

How do I set these to test then? Probably better to PM me rather than tell the whole CLEO community

 

There's enough clues already on this thread. Basically just setup Tor to use the HTTPS server. Then you just need to force it to connect to a Tor server running on port 443. The most idiot proof way to do this is to run one on your machine at home. There's plenty of information in the Tor documentation on how to do all these steps.

 

It's the same basic principle as the SSH tunneling method I previously outlined.

[tom_newton]

Geoff: Probably best to snort it, however blacklists have their uses, and the list of tor directories is quite small, AFAIK.

 

(directories are where you go to get a list of tor nodes)

[Geoff]

I am well aware of how the Tor directory protocol works. I just don't see the point of blocking IP's when there's no reason.

[IanB]

My, how this thread has grown since I looked this morning!

 

@plexer: Thanks for the clarification @Geoff Sorry I misunderstood you. I agree that obscurity is not the best form of security.

 

I've carried out some further tests and found that our on-site firewalls seem to block the connection from Torpark to outside. Which is a relief

Can still use it from the office though..

[tom_newton]

I am well aware of how the Tor directory protocol works. I just don't see the point of blocking IP's when there's no reason.

 

I'd guessed you might be - the parenthesised comment was largely for the benefit of anyone following the thread!

 

Potentially, Snort is the "top answer" - however a multidentate approach is often necessary to stand a good chance of working in "most" cases - so we'll probably look at at least 3 alternatives and hope to implemet 1 or 2.