Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 29 subscribers
  • Views 2238 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to block Squid Proxy using Application Control?

Vineeth Penugonda

Hi guys,

How to block Squid Proxy using Application Control? Few applications like Hoxx VPN use Squid Proxy over port 80/443 to evade detection.

Regards



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    you create policy blocking proxy and tunnels. There is a category already in the XG, you need to add it to your application policy and it will need to be in every firewall rule that the users have access to.

    Ian

  • 0 in reply to rfcat_vk

    I did some packet inspection, and Hoxx VPN is connecting to some unknown addresses. It uses TLS v1.3. When I checked the address in Sophos, it showed up in the "Content Delivery" category.

  • 0 in reply to Vineeth Penugonda

    You could try creating FQDN group with hoxx.com and *.hoxx.com and then create a rule at the top of your rule list as a block to this FQDN group. I was unable to find a server list for the app. The security rating on hoxx.com is not great so a DNS block might just work?

    You might also need to block browser extensions.

    Ian

    I downloaded the app to my mac book, apple blocked the installation as untrustworthy, though that can be bypassed and the I tried the firefox extension but that would not install on my firefox app.

Reply
  • 0 in reply to Vineeth Penugonda

    You could try creating FQDN group with hoxx.com and *.hoxx.com and then create a rule at the top of your rule list as a block to this FQDN group. I was unable to find a server list for the app. The security rating on hoxx.com is not great so a DNS block might just work?

    You might also need to block browser extensions.

    Ian

    I downloaded the app to my mac book, apple blocked the installation as untrustworthy, though that can be bypassed and the I tried the firefox extension but that would not install on my firefox app.

Children