Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for internet access, I have begun to see more applications circumvent this by forwarding a URL request to the browser. This is especially suspicious when the GET query includes long cryptic strings...

Does anyone know of any Windows or cross-platform solutions that either ask the user for confirmation before proceeding to the URL or at least check against a whitelist/blacklist beforehand?

For my purposes, any block that only occurs after the browser has attempted to reach the URL is unsuitable; although this is common for somewhat different reasons in a corporate setting.

Clarification: This user confirmation of outgoing URL should only be for URLs requested from outside the browser. i.e. Some OEM bloatware or a blackbox freeware app decides to open a browser window without permission to xyz.com/cgi?mysterious_string on install, uninstall or some other hermetic app decision.

share|improve this question

1 Answer 1

There are a few different approaches.

One option would be to implement a content filtering proxy. You could install one locally or at the network level. You could force a whitelist and then configure it to prompt on every URL that is not in the whitelist. However, I imagine for most people working with a whitelist is a huge pain. However, many content filtering proxies maintain blacklists or have heuristics to analyze a page before loading the page.

Many browsers and search engines now identify truly malicious pages before they are loaded as well.

In Internet Explorer you can configure Security Zones and apply different levels of security based on this. For example, you can add sites to the "Trusted" sites which you apply less scrutiny on and then there are "Restricted" sites which are more or less a black list. There is a general setting for the "Internet", you can customize the level for Internet sites (which are of course exclusive of those in the "Trusted" list) to do things like disable plugins, disable downloads, etc. I do not believe you could require a prompting for each site in the Internet zone, but I think sites in the Restricted zone can either be blocked or force the user to clear a warning message. I am not sure if the Zone settings affect other browsers since there is some integration with IE's internet settings and the OS.

There are also any number of plugins for the various browsers to add blacklisting, heuristics and plenty of other security features. One that might be a good fit for your needs is Web of Trust, which has implementations for multiple browsers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.