Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working for a high school. We have given every student their own laptop. Some of our students have figured out how to bypass our web filter using a program called Ultrasurf.

If you're not familiar with it, Ultrasurf is sort of like a proxy service. It basically goes online and downloads a large list of proxy servers from a google docs file and then randomly connects to one. We obviously can't block Google docs. It tends to use port 443 so we obviously can't block that without using HTTPS and the list of host it downloads is too long to filter all of them.

Is there any way of blocking it?

If not, I had another idea. Since these are our laptops, we have some degree of control over the software. We use McAfee's enterprise AV software. I'm not an expert when it comes to McAfee. Is it possible to create a custom signature for McAfee? If so, can we create a signature so that McAfee will think this program is malicious and simply delete it every time it is downloaded? We don't see much Tor activity but I assume such a trick would also let us gut Tor if our students learn about it.

share|improve this question
    
Hello Monsuco and welcome to Security.SE. Unfortunately it almost impossible to protect computers to which adversaries have physical access to. Furthermore, your adversaries have a lot of time, motivation and probably technology skills. I suggest to approach this issue from a social angle: Create a set of rules for acceptable use of school property with realistic (!) consequences for concrete types of misuse. –  Hendrik Brummermann Sep 5 '13 at 7:54

1 Answer 1

Yeah, setup Rules, let your student sign these rules, and then BANG those guys'n'girls who are doing workarounds (or let them pay for professional virus-desinfection :)

the other (right) way is to use a transparent proxy on your firewall that filters http/https - traffic. on thta transparent proxy you can whitelist/blacklist.

and you MUST block outgoing requests, if not via transparent proxy.

hw-firewalls usually have this feature, and also the ability to use category-based webfilters

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.