Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Linux
[Top] [All Lists]

Re: can Hopster traffic be blocked?

Subject: Re: can Hopster traffic be blocked?
Date: Thu, 12 Aug 2004 10:38:30 +0200

Any suggestions on how I can block hopster (and other similar socks
based tunneling applications) from tunnelling out. 
I bet all my weekend beers that the only way out is content filtering 
done at the proxy level. Maybe squidguard/dansguardian could help. Or 
snort. Otherwise .. IBM websense.

My first try would be iptables with strings module loaded.
Check all allowed http ports for CONNECT strings.

The second try (for more detailed analysis) would be squid in transparent mode.
With squid you can add traffic analysis software and look for long-running 
connections with "bad" upload/download rates.
The typical proxy connection will have a different access pattern (longer 
connections, different connection times, higher upload rates) than normal HTTP 
traffic.
Using CONNECT can be detected as well. You will get a more comprehensive Image 
of what your users are doing, with forensic info, if you like.

Greetings,
Stefan Osterlitz






<Prev in Thread] Current Thread [Next in Thread>