Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 40 replies
  • Subscribers 1 subscriber
  • Views 26961 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Ultra Surf 8.8 How to block?

Surfman1124
We have had several students find this new filter work around. It's called Ultra Surf from www.wujie.net

It comes from Ultrareach and has been very hard to stop. Has anyone run into this Anonymous proxy?
We have found the the program runs on port 9666.
We blocked all outbound traffic on 9666. Still will not stop it.
Found a forum that says to block server 67.15.183.30. Still will not stop it.
It has to be some sort of bot that has servers all over the place that it changes ports and server IP's.

Anyone, Anyone?


This thread was automatically locked due to age.
Parents
  • 0
    We have had several students find this new filter work around. It's called Ultra Surf from www.wujie.net

    It comes from Ultrareach and has been very hard to stop. Has anyone run into this Anonymous proxy?
    We have found the the program runs on port 9666.
    We blocked all outbound traffic on 9666. Still will not stop it.
    Found a forum that says to block server 67.15.183.30. Still will not stop it.
    It has to be some sort of bot that has servers all over the place that it changes ports and server IP's.

    Anyone, Anyone?

    just about every proxy software and p2p client will now do an internal portscan against your firewall if it finds itself blocked.  I bet it is falling back to port 80 and/or 443.  Other than routing them through a standard proxy(instead of transparent) and locking it down that way there's no easy way to block traffic like this.  Make a strong policy that includes removal of network access and strictly and rapidly enforce it.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    Even better would be an IPS rule (one that we could either add manually, or be able to select as a "Policy" rule, like in Version 6) that could detect a pattern of traffic that indicates that particular app is being used.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to kuijlaars
    it would be nice if i was possible to block all public web proxy's. extending the http filter with anonymous- web proxy's would be realy great.


    can't filter what you can't read.  ultrasurf encrypts the traffic going out..this means the proxy can't see what hte3 traffic is so it's effectively blinded.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    ultra surf uses https port 443 to connect to its parent proxy. Find the IPs of the proxies that it is connecting to and create a packet filter rule to deny the connection.
  • 0 in reply to Billybob
    There is another possibility now with the advent of the new AFC engine in 7.200 ... perhaps Astaro may use it in the future to analyze and block programs like these as well...

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to BrucekConvergent
    Ultra Surf have tons of IP addresses.
    So it's impossible to add the IP.
    Every time Ultra Surf making a connection, the log (Content Filter) would appears url="X.X.X.X:443" with randomize IP addresses.
    After that, the client become invisible (not recorded by Astaro) and they can browse to any sites.

    So I tried with Regular Expressions in Content Filter:

    1. ([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\:443

    2. [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\:443

    The result Ultra Surf cannot connect anymore.
    I'm not add packet filter rule for blocking.
  • 0 in reply to 1771k3
    Good day!  Has anyone made progress in defeating Ultrasurf?
  • 0 in reply to jmvcruz
    Just give up.  IT at my school has tried and failed to beat us.  You cannot win.
  • 0 in reply to bobo_bobbins
    7.400 will be including a new HTTPS proxy... which can scan content... this may help.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0 in reply to BrucekConvergent
    As Bruce mentioned, 7.400 includes the ability to decrypt https at the gateway for inspection.  There will certainly be a few issues to consider in implementing this function, but it will provide a substantially improved a level of control.
  • 0 in reply to bobo_bobbins
    Just give up.  IT at my school has tried and failed to beat us.  You cannot win.


    Technology alone can't fully address the issue.  At some level people in supervisory positions have to be involved- whether teachers, administrators, managers, etc.
  • 0 in reply to Jack Daniel
    Hi guys, 

    i just tried the latest version of Ultrasurf 9.2 to be able to go through the new web security package of ASG 7.400 BETA.

    and the result is ...  yes, Astaro Security Gateway can block ultrasurf without a problem.
    see the attached image and logfile excerpt. 


    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="61224 ms" request="0xb18ede98" url="91.109.241.179" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="60195 ms" request="0xada5c1b0" url="91.121.65.41" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="63229 ms" request="0xb2edada8" url="91.127.203.140" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="60194 ms" request="0xadafd900" url="88.203.6.227" error="Connection to server timed out"

    2008:11:21-23:13:24 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="400" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="2079" time="1 ms" request="0xada5c1b0" url="" error="Received invalid request from client"

    2008:11:21-23:13:27 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="64191 ms" request="0xad8a6170" url="91.111.95.31" error="Connection to server timed out"

    2008:11:21-23:13:32 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="65138 ms" request="0xb1a5abb0" url="91.55.221.219" error="Connection to server timed out"


    regards
    Gert
Reply
  • 0 in reply to Jack Daniel
    Hi guys, 

    i just tried the latest version of Ultrasurf 9.2 to be able to go through the new web security package of ASG 7.400 BETA.

    and the result is ...  yes, Astaro Security Gateway can block ultrasurf without a problem.
    see the attached image and logfile excerpt. 


    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="61224 ms" request="0xb18ede98" url="91.109.241.179" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="60195 ms" request="0xada5c1b0" url="91.121.65.41" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="63229 ms" request="0xb2edada8" url="91.127.203.140" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="60194 ms" request="0xadafd900" url="88.203.6.227" error="Connection to server timed out"

    2008:11:21-23:13:24 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="400" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="2079" time="1 ms" request="0xada5c1b0" url="" error="Received invalid request from client"

    2008:11:21-23:13:27 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="64191 ms" request="0xad8a6170" url="91.111.95.31" error="Connection to server timed out"

    2008:11:21-23:13:32 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="65138 ms" request="0xb1a5abb0" url="91.55.221.219" error="Connection to server timed out"


    regards
    Gert
Children
  • 0 in reply to Gert Hansen
    Hi guys, 

    i just tried the latest version of Ultrasurf 9.2 to be able to go through the new web security package of ASG 7.400 BETA.

    and the result is ...  yes, Astaro Security Gateway can block ultrasurf without a problem.
    see the attached image and logfile excerpt. 


    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="61224 ms" request="0xb18ede98" url="https://91.109.241.179" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="60195 ms" request="0xada5c1b0" url="https://91.121.65.41" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="63229 ms" request="0xb2edada8" url="https://91.127.203.140" error="Connection to server timed out"

    2008:11:21-23:13:22 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="60194 ms" request="0xadafd900" url="https://88.203.6.227" error="Connection to server timed out"

    2008:11:21-23:13:24 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="400" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="2079" time="1 ms" request="0xada5c1b0" url="" error="Received invalid request from client"

    2008:11:21-23:13:27 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="64191 ms" request="0xad8a6170" url="https://91.111.95.31" error="Connection to server timed out"

    2008:11:21-23:13:32 (none) httpproxy[6663]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="10.254.3.239" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="65138 ms" request="0xb1a5abb0" url="https://91.55.221.219" error="Connection to server timed out"


    regards
    Gert


    Dear Sir,
    how to block ultrasurf with astaro home edt. 7.5
    if is it possible, please upload configuration screenshots step by step.
    thank you.