Proxy sites now using 443

[steele_uk]

Not sure if this is a new thing or not - i did a search and couldn't see a mention of it. Students are now using proxy sites that bypass our ISA server and any of counties restrictions because they are being set to use port 443. It took me a couple of days to work out what was going on in the logs. We have massive amounts of sites with a :443 ending. They can't simply be blocked by domain name as the name seems to be virtually random. It doesnt seem to link anyway if you try and click it.

 

Here is an example of whats in our logs

 

c-24-17-137-27.hsd1.wa.comcast.net:443

 

Any idea's how to get round it?

 

Blocking port 443?

 

Cheers

[webman]

You could do, but blocking port 443 outbound would also block all secure HTTP connections (https://.......).

[Midget]

Block all 443 and then whitelist as required?

[Geoff]

I concure, that'd be the only way to do it. You can't filter on content on https. As it's encrypted.

[ICTNUT]

This is exactly how we do it in ISA 2004 Block all port 443 traffic and then get staff to request whitelist sites.

 

Student has no need for access to 443 really, the only ones that I found did need it was our sixth form and access to the UCAS site.

[steele_uk]

The blocking :443 and then whitelist by agreement seems like the way forward.

 

Do i prepare myself for a lot of abuse from staff that can access their bank details, or more importantly can't buy their DVD's from Play.com?

:x

[Midget]

yes. and then you tell them that it is a security thing and they should not be using the school computers for private affaires

[Geoff]

Infact, that really should be in your staff AUP anyway.

[mrforgetful]

You can set ISA to unpack all the HTTPS traffic to inspect it can't you? It can then either send it unencrypted through school or repack it up after inspection.

[tom_newton]

You can man-in-the-middle SSL traffic, yes, but I don't recommend it. It's actually illegal in some countries, and rightly so - it is a gross invasion of privacy, and a security risk.

 

The "HTTPS" whitelist appears to be the way forward for most users.

[mrforgetful]

On the Microsoft ISA Course it is pushed as a err how do you phrase it, Security Anti-Risk for the exact reasons it would be helpful here - that otherwise anyone could be wrapping anything up in SSL, virus's etc and you'd have no idea.

[steele_uk]

Infact, that really should be in your staff AUP anyway.

 

I know. Another Reason the ICT-Co-ordinator should not be responsible for the AUP (imho)

[ConTheITGuy]

I concure, that'd be the only way to do it. You can filter on content on https. As it's encrypted.

 

Not wanting to be a pedant (or a pendant as GD would say). I gather that is a typo and that you do indeed mean can't filter on content?

 

Cheers,

 

 

Andy

[Geoff]

indeed I did andy.

[mrforgetful]

The argument that was put to the Headmaster at this school was that if the Teachers were expected not to be able to do the odd personal thing online during their free periods or whatever, then they weren't going to do any work at home in their personal time either.

[localzuk]

But that is not how their contracts work. The staff are paid to do a job - that job isn't listed as being an 8:30 - 4:00 job and entails working at home, marking and the like. This is accepted as the way the job is and is the exact reason teachers get huge holidays, unlike support staff who don't *have* to do work at home (but often do) and don't get the holidays.

 

Arguing that they should be able to misuse the school equipment still wouldn't fly with me.

[mrforgetful]

But at the end of the day, not my decision and I'm really not fussed.

 

If people get their work done and don't cause problems I don't see why I should mind if they spend 5 minutes the day after they get paid checking during school time that there's money in the bank or whatever.

[ICTNUT]

If you employ some sort of filtering solutions you can (in theory) setup "Working Hours".

 

I have that at my place where during working hours things like webmail and banking cannot be accessed but before and after school and during lunch staff can access them.

 

Stuff like ebay and the likes are banned anyhow as part of the AUP (which I belive if you gonna set it up right then the NM should do it).

[tom_newton]

Teachers are unlikely to use the proxy - so maybe just block https (except whitelisted sites) for pupils?

[ahuxham]

The argument that was put to the Headmaster at this school was that if the Teachers were expected not to be able to do the odd personal thing online during their free periods or whatever, then they weren't going to do any work at home in their personal time either.

 

I'd love too see that attitude in effect, come end of term, end of year, exam time etc, doing nothing at home will only thwart them, as they're going to have to stay behind at school and get everything done, as per contract, all marking, exam preparation, grades, reports HAVE to be done.

 

It's perfect, adopt that attitude and a mountain of garbage comes your way, win win to be honest!

[Daleus]

Sorry to bring up an old thread: but this is an old trick we used to use at College, Open up a SSH connection to your home machine using port 443, because most firewalls allow it for HTTPS and you can use the tunnel for the internet, that is why there seems to be 'no pattern'

 

of course, once the other students work out that you can do it, you end up being the local jailed shell host

 

 

*edit, also SSH won't be so easily sniffed at,*

[Geoff]

Performing a man in the middle attack on SSH sessions on the school proxy and injecting 'rm -rf /' and 'deltree C:\*.* /Y' commands is fun.

[tom_newton]

Guardian can block such things - we check to see that any host connected to on 443 presents a valid cert - blocking most "tunneling" activity. It also blocks a lot of https web proxies, by checking for self-signed certs, you can whitelist out any you need.

[Daleus]

'rm -rf /'

 

Jailed Shell accounts for reasons like this, also SSH2 is quite hard to sniff, have a go, you'll be pleasently surprised.

[Geoff]

Jailed Shell accounts for reasons like this, also SSH2 is quite hard to sniff, have a go, you'll be pleasently surprised.

 

which is why I throw in a 'rm -rf ~' for good measure. Anyway, I'm not sniffing, I'm intercepting.