Comments on: How to tell if proxy pattern blocking is working http://8e6labs.com/2007/11/19/how-to-tell-if-proxy-pattern-blocking-is-working/ Security insights and trends, best practices, and working with 8e6's products Wed, 20 Aug 2008 01:56:20 +0000 http://wordpress.org/?v=2.6 By: 8e6 Labs: IT Security Blog » Blog Archive » ISP netblocks allocated to home computers are bot and proxy farms … http://8e6labs.com/2007/11/19/how-to-tell-if-proxy-pattern-blocking-is-working/#comment-40 8e6 Labs: IT Security Blog » Blog Archive » ISP netblocks allocated to home computers are bot and proxy farms … Wed, 09 Jan 2008 21:53:35 +0000 http://8e6labs.com/?p=20#comment-40 [...] Anonymous proxies fit this model as well. Proxy packages are designed to be installed on user’s home computers and accessed from work (an overview of this problem is here and how we handle it is here). [...] [...] Anonymous proxies fit this model as well. Proxy packages are designed to be installed on user’s home computers and accessed from work (an overview of this problem is here and how we handle it is here). [...]

]]> By: 8e6 Labs: IT Security Blog » Blog Archive » Proxy blocking improvements in the new version of the R3000 http://8e6labs.com/2007/11/19/how-to-tell-if-proxy-pattern-blocking-is-working/#comment-25 8e6 Labs: IT Security Blog » Blog Archive » Proxy blocking improvements in the new version of the R3000 Thu, 27 Dec 2007 17:51:28 +0000 http://8e6labs.com/?p=20#comment-25 [...] We’ve fixed one of the most confusing aspects of the product when it comes to figuring out whether or not our proxy pattern blocking is working. In previous versions of the filter, we would simply send a TCP reset back to the browser, which makes the user (or admin testing our product) think a network error occurred. Now, we’ll actually show a block page. The details, including screen shots, can be found in this previous post. [...] [...] We’ve fixed one of the most confusing aspects of the product when it comes to figuring out whether or not our proxy pattern blocking is working. In previous versions of the filter, we would simply send a TCP reset back to the browser, which makes the user (or admin testing our product) think a network error occurred. Now, we’ll actually show a block page. The details, including screen shots, can be found in this previous post. [...]

]]> By: Rich Sutton http://8e6labs.com/2007/11/19/how-to-tell-if-proxy-pattern-blocking-is-working/#comment-23 Rich Sutton Thu, 20 Dec 2007 00:57:29 +0000 http://8e6labs.com/?p=20#comment-23 Thanks for the comment - we just had someone test out delprox.com and we're blocking it by pattern. It looks like a standard PHProxy installation, so that's what I would expect. I'll ask one of our Tech Support folks to contact you to double check your config. And by the way - I totally agree with your "not everything is 100%" comment. Nothing drives me crazier than when marketing departments (including ours) trot out the 100% effectiveness claim. As anybody who's been in the trenches can tell you, security requires constant vigilance. For a security software vendor, this means the ability to quickly turn around product enhancements and improvements when the bad guys get out in front. Thanks for the comment - we just had someone test out delprox.com and we’re blocking it by pattern. It looks like a standard PHProxy installation, so that’s what I would expect. I’ll ask one of our Tech Support folks to contact you to double check your config.

And by the way - I totally agree with your “not everything is 100%” comment. Nothing drives me crazier than when marketing departments (including ours) trot out the 100% effectiveness claim. As anybody who’s been in the trenches can tell you, security requires constant vigilance. For a security software vendor, this means the ability to quickly turn around product enhancements and improvements when the bad guys get out in front.

]]> By: meltonn http://8e6labs.com/2007/11/19/how-to-tell-if-proxy-pattern-blocking-is-working/#comment-22 meltonn Tue, 18 Dec 2007 22:41:30 +0000 http://8e6labs.com/?p=20#comment-22 But not everything is 100%. As an 8e6 client, and we've had several different filtering products, your product is one of the best seen for blocking proxies. But there are some site-based proxies that do still work (example-which I sent today for URL filtering- delprox.com). Could this be a new version of the proxy code that does not match the patterns? BTW- Thanks for doing the blog. I'm finding very useful items here, Rich. But not everything is 100%. As an 8e6 client, and we’ve had several different filtering products, your product is one of the best seen for blocking proxies. But there are some site-based proxies that do still work (example-which I sent today for URL filtering- delprox.com). Could this be a new version of the proxy code that does not match the patterns?

BTW- Thanks for doing the blog. I’m finding very useful items here, Rich.

]]>