5

There are two things I can think of, neither fits the bill perfectly, and there's some assembly required. squid with sslBump and the SSL Server Certificate Validator This is basically an MITM SSL proxy configuration, and you get to provide an external "helper" that augments normal verification. Stumbling blocks include certificate trust and managing your ...


4

DNS and ICMP are not good examples, because in a well configuration, network access is restricted by use of a proxy to thwart DNS and ICMP right from the start. But there‘s HTTP(S) still available through the proxy. Usually, websites are not whitelisted in a proxy, so this should work quite well. As to the content inspection: You can not do that in ...


4

At first I would recommend to not only read the homepage of the vulnerability but the actual paper since it has far more details. Your questions are both answered when reading the paper. Why is it recommended to completely disable HTML rendering? Would it not be enough to disable loading of remote content (which is the default in most modern mail programs ...


3

There is no simple way to move files between computers and preventing other files from being moved. Yes, what you described is not only possible for malware, but was famously pulled of to destroy Iranian centrifuges by the Stuxnet virus. As for some of your ideas. Most of them won't work. The virus can just write into unused space on the storage device and ...


3

While HTTPS makes it much harder to detect malware from traffic payload the communication can also be hidden with plain HTTP. This is done for example by encrypting the transferred messages with a shared secret or by using steganographic techniques. Still, detection might still be possible by looking at the meta data of the traffic instead of the content. ...


2

Some remote desktop protocols have a shared clipboard. In this case, exfiltrating data is simply a matter of copy-and-paste: copy on the remote desktop, paste on the local one. Some protocols have built-in file transfer. Exfiltrating data becomes as simple as dragging the database files from the remote desktop to the local one. All remote desktop ...


2

Standard disclaimers apply, however user Lighty is correct in that it's a proxy server. Proxies operate by filtering websites by URL, IP, content, or category. Websites like Facebook, Twitter, and LinkedIn are categorized as "Social Networks" and your company sounds like it blocks access to them. Youtube, Hulu, and Netflix are all probably categorized as "...


2

You allow the advertising partner’s code in the context of your page, giving it full access to the DOM and everything on the page. If the script is compromised and you load it there isn’t much you can do. There is however, a way to detect if the script you are including has been altered from a previously known state. This is called Subresource Integrity. ...


1

One of the goals we have with the research papers is to save other companies time and effort in moving to a BeyondCorp model, especially because as we've grown the model internally we've opened up many of the elements to others to use. On Google Cloud this is collected under the umbrella of Context-Aware Access. The best way to stop malware is binary ...


1

After a few trials and errors, I have manage to extract data but also I find the following article one of the most comprehensive reaource for data exfiltration using excel formula: https://www.notsosecure.com/data-exfiltration-formula-injection/ CONCATENATE: Appends strings to one another. =CONCATENATE(A2:E2) IMPORTXML: Imports data from various ...


1

You can filter by certificate using an SSL-terminating proxy, as Mr Spuratic explains well. However, turning an SSL pass-through proxy to an SSL-terminating proxy is quite a big deal, and not something you would do purely for the motivation you outline. Your best pragmatic option is to filter by host name.


Only top voted, non community-wiki answers of a minimum length are eligible