[TheAge]Cisco shines light on dark corners(Dark web) of the Web - Overclock.net

5entinel · 10-10-09

Quote:

Cisco launched software that shines light on potentially troublesome websites hidden in what the US computer security firm dubbed the "Dark Web."
Cisco IronPort Web Usage Controls promise to identify as much as 90 percent of "egregious" content that has escaped detection by business IT managers and security applications because of its stealthy nature on the Internet.

"The Dark Web is about corporate users' inability to see how workers are using the Web," Cisco product line manager Kevin Kennedy told AFP on Thursday.

http://news.theage.com.au/breaking-n...1009-gq3y.html

*VulcanDragon* · 10-10-09

Hmm...I'm about to buy a couple of IronPort appliances, just sent the purchase documents to accounting last week.

Tator Tot · 10-10-09

Hmm...I wonder how long till we see this implemented at the public school level, and then how long until it is circumvented.

though, I'd love to see how this stops proxy websites.

Such matters are always interesting as far as how well they work and how fast they are worked around.

*VulcanDragon* · 10-10-09

Quote:

Originally Posted by Tator Tot

Hmm...I wonder how long till we see this implemented at the public school level, and then how long until it is circumvented.

though, I'd love to see how this stops proxy websites.

You basically can't if they are configured correctly. The IronPort (or any other web content filter) sits between your outbound line and the internet...any and all outbound requests are examined by the device. So you can be blocked before you ever get to the proxy site in the first place, if "proxy sites" is a category that the IT administrator blocks.

And even if it is in non-blocking mode, your access to that site is logged; so a network admin doing their job could see that you are sending all of your outbound traffic to a proxy site...and what reason would you have to do that except that you're getting around the more specific rules in the device, right?

In theory, the only way to get around this stuff is if your network admin hasn't locked things down tightly. Which is often the case for internal political reasons (the boss likes Facebook), or the IT staff just isn't all that great (a scenario I might expect in some schools).

Tator Tot · 10-10-09

Quote:

Originally Posted by VulcanDragon

You basically can't if they are configured correctly. The IronPort (or any other web content filter) sits between your outbound line and the internet...any and all outbound requests are examined by the device. So you can be blocked before you ever get to the proxy site in the first place, if "proxy sites" is a category that the IT administrator blocks.

And even if it is in non-blocking mode, your access to that site is logged; so a network admin doing their job could see that you are sending all of your outbound traffic to a proxy site...and what reason would you have to do that except that you're getting around the more specific rules in the device, right?

In theory, the only way to get around this stuff is if your network admin hasn't locked things down tightly. Which is often the case for internal political reasons (the boss likes Facebook), or the IT staff just isn't all that great (a scenario I might expect in some schools).

This is very true. (IE the bolded part.)

But I'm not bound to thinking it's impossible to get passed this. It'd just be constant uphill battle it seems like.

Though, this is definitely some hardcore lockdown software.

*VulcanDragon* · 10-10-09

Quote:

Originally Posted by Tator Tot

But I'm not bound to thinking it's impossible to get passed this. It'd just be constant uphill battle it seems like.

Though, this is definitely some hardcore lockdown software.

Well you're right, nothing is impossible. But keep in mind, this isn't just software...these are hardware appliances. The software part can certainly be hacked, all software can be hacked. But your average web hacker isn't going to know what he's doing, he will be playing in a sandbox he's not used to. You would have to have some pretty good skills to figure out how to pick the locks, I would think...and since we're only talking about people on the inside trying to "get out" so they can "goof off" instead of working, the likelihood is probably low.

Tator Tot · 10-10-09

Quote:

Originally Posted by VulcanDragon

Well you're right, nothing is impossible. But keep in mind, this isn't just software...these are hardware appliances. The software part can certainly be hacked, all software can be hacked. But your average web hacker isn't going to know what he's doing, he will be playing in a sandbox he's not used to. You would have to have some pretty good skills to figure out how to pick the locks, I would think...and since we're only talking about people on the inside trying to "get out" so they can "goof off" instead of working, the likelihood is probably low.

Most definitely.

The hardware part of it is what's going to be the most interesting to see if it's cracked or they find a bypass for.

Coma · 10-10-09

Quote:

Originally Posted by VulcanDragon

You basically can't if they are configured correctly. The IronPort (or any other web content filter) sits between your outbound line and the internet...any and all outbound requests are examined by the device. So you can be blocked before you ever get to the proxy site in the first place, if "proxy sites" is a category that the IT administrator blocks.

And even if it is in non-blocking mode, your access to that site is logged; so a network admin doing their job could see that you are sending all of your outbound traffic to a proxy site...and what reason would you have to do that except that you're getting around the more specific rules in the device, right?

In theory, the only way to get around this stuff is if your network admin hasn't locked things down tightly. Which is often the case for internal political reasons (the boss likes Facebook), or the IT staff just isn't all that great (a scenario I might expect in some schools).

Well, a good blocking device should inspect your communication with the proxy (if it's unencrypted, and most people use unencrypted proxies) and see which sites you are accessing through it, blocking it as if it was a normal HTTP request. But I've yet to see even one that does this.

Quote:

Originally Posted by VulcanDragon

Well you're right, nothing is impossible. But keep in mind, this isn't just software...these are hardware appliances. The software part can certainly be hacked, all software can be hacked. But your average web hacker isn't going to know what he's doing, he will be playing in a sandbox he's not used to. You would have to have some pretty good skills to figure out how to pick the locks, I would think...and since we're only talking about people on the inside trying to "get out" so they can "goof off" instead of working, the likelihood is probably low.

Why would ANYONE ever consider hacking this device to get past it? If you're intelligent enough, you'll just go through an encrypted proxy (SSH tunnel)... though I guess you could get found out if the IT admin isn't that stupid.

But then again, you could set up your rig so that it visits many other (unblocked) webpages regularly to obfuscate your proxy traffic.

*VulcanDragon* · 10-10-09

Quote:

Originally Posted by Coma

Why would ANYONE ever consider hacking this device to get past it? If you're intelligent enough, you'll just go through an encrypted proxy (SSH tunnel)... though I guess you could get found out if the IT admin isn't that stupid.

Exactly. All traffic is monitored, so it doesn't take a rocket scientist to identify questionable behavior. And once someone is identified, serious monitoring on that person can easily find out what he's doing. There is no way to avoid "Big Brother" at work/school if the IT guys know what they are doing and have time to do anything about it. (Those are big "if"s.)

subliminally incorrect · 10-10-09

beh, there are other means in the workplace to access the web and that is mobile browsing.

		Overclock.net - Overclocking.net > Industry News > Software News
[TheAge]Cisco shines light on dark corners(Dark web) of the Web

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)