topic Re: Students, using HTTPS now on Proxies in General Topics

Students, using HTTPS now on Proxies

djbisbey — Tue, 30 Nov 2010 07:59:28 GMT

Hi,

we have banned the http-proxy in school to stop them downloading and accessing sites they shouldn't, however they have now found using https based proxies bypasses this.

What is my next possible solution in my ever on going war with students.

Any advice / help much appreciated.

Thanks in advance.

Darren

Re: Students, using HTTPS now on Proxies

reaper — Tue, 30 Nov 2010 08:26:02 GMT

Hi Darren

you could give SSL decrypt a try ?

that will enable you to intercept encrypted traffic and analyse it as any other traffic.

Drawback might be that you either need to get a certificate on your paloalto and have the students import your cert as trusted or have a not-so-nice certificate error appear in their browsers.

regards

Tom

Re: Students, using HTTPS now on Proxies

Klein_it — Tue, 30 Nov 2010 20:17:12 GMT

I am also in a school enviroment and we setup a proxy application filter and block all the fall into the filter.

Re: Students, using HTTPS now on Proxies

dagibbs — Mon, 06 Dec 2010 04:08:50 GMT

Darren.

You could go for either an SSL decrypt - which would lead to a lot of messay (and very obvious) certificate errors on the client unless yous omehoe force distribute the self signed certificate out of the PA.

Or you could create an Application Filter, add the sub-category Encrypted tunnel to it and add the application fitler to your "deny" rule. This stops most of the commonly identified tunnels - especially if you set it "any" in the service section of the deny rule (which you should do anyway).

Cheers

Re: Students, using HTTPS now on Proxies

djbisbey — Mon, 06 Dec 2010 08:25:10 GMT

Problem is...

in doing that they cannot go to legit SSL sites, essentially if I block SSL they cannot use https-proxy but if I do that they cannot use their webmail or SSL encrypted sites...

Interesting one this..

It might be just beyond the powers of this wonderful product. I wonder if I have found something it cannot actually do, I'd be amazed if that was the case.

Darren

Re: Students, using HTTPS now on Proxies

bpappas — Mon, 06 Dec 2010 14:38:07 GMT

What proxies are the students using? In many cases your PA firewall has applications defined to identify well known proxy services (e.g. ultrasurf).

If the students discover a proxy service that is not part of the PA application ecology please open a ticket and let us know so that we can improve the product.

Re: Students, using HTTPS now on Proxies

dagibbs — Mon, 06 Dec 2010 21:07:17 GMT

darren.

Not true. SSL != Encrypted tunnel.

Have a look through your traffic logs while this is happening. You should see packets which list "protocol" as SSL - but Application as something else.

The PA is smart enough to stop the unallowed applications while allowing "normal" web browsing-based SSL (I.E. banking sites, shopping sites etc).

http-proxy is not required for legitimate SSL sites, as far as I know.

So - create an aplication filter called "tunnelling" or soemthing similar, add the sub-category "encrypted tunnel" to it, and then apply this application filter to a security policy with a DENY rule while leaving (or adding) SSL into your "allow" rule.

Cheers.

Re: Students, using HTTPS now on Proxies

bjdraw — Tue, 07 Dec 2010 02:41:03 GMT

You could also block the destination IPs since odds are they are only used for SSL tunnels, but talk about a cat and mouse game.

Re: Students, using HTTPS now on Proxies

djbisbey — Tue, 07 Dec 2010 10:02:18 GMT

Ok I think I need to clarify a little...

The students have found that using sites like https://proximize.me they can go to sites that are normally banned either by URL or APP.

Sadly the BrightCloud URL filter is less than perfect so the students do find proxy sites

dagibbs stated that if I look at the logs I will Protocol as SSL this is not correct.

I have been to this proximize site and browsed around the internet, OK all be it slowly..but it still bypass all application and url filtering not good.

All I see is the protocol TCP (if I am not mistaken the protocol is either TCP or UDP) and application ssl.

So essentially the PA see's their traffic as SSL nothing more than that.

See the PA.jpg below, this is me browsing through the proxy, as you can see web-browsing and SSL are the only ones present, I think the web-browsing is my other browser window open which is normal internet.

So even if I selected 'encrypted-tunnel' it wouldn't make any difference what so ever as the PA is only seeing SSL traffic, its not seeing anything else.

Presently the only way to stop this type of browsing is to block SSL which of course has other implications...

Thoughts?

Re: Students, using HTTPS now on Proxies

djbisbey — Tue, 07 Dec 2010 14:02:33 GMT

Resolved!

SSL Decrypt...

LOVE this PA what a unit...

Re: Students, using HTTPS now on Proxies

dagibbs — Tue, 07 Dec 2010 21:19:05 GMT

OK.

Looking at the URL categorisation for this site in brightcloud it comes up in the "proxy Avoid and Anonymizers" category - so the simplest solution would be to apply a URL filter profile which blockas this category in its entirety (deny) and apply that profil to your outbound interface.

Because it's an atempted SSL connection, the users will get no nice "Access denied" banner because the PA can't do that for HTTPS connections - but it should block them anyway owing to the database categorisation.

Of course, if you don't have a valid web filter license you mgiht be in trouble. 🙂 I'm not sure if you can still create custom URL filter cetagories without the "general" web filter license, but you could try that also - create a custom URL filter category, add your proxy site to it, set it in a URL filter profile for "deny" with everything else allowed.

Or you could, as suggested, so SSL decrypt and stop them that way.

Cheers.

Re: Students, using HTTPS now on Proxies

djbisbey — Wed, 08 Dec 2010 08:11:24 GMT

Dagibbs,

I cannot award myself the Answer points, so I will give them to you for your help.

Darren

Re: Students, using HTTPS now on Proxies

James — Wed, 08 Dec 2010 08:50:30 GMT

Liking your style

Re: Students, using HTTPS now on Proxies

migration — Thu, 06 Jan 2011 13:49:10 GMT

Can you share how you set up the SSL Decryption with another school district tech having the same issue? I'm not having any luck. Thanks!

Re: Students, using HTTPS now on Proxies

tontabli — Sat, 08 Jan 2011 21:34:33 GMT

There is a bug with application filtering, it doesn't seem to work on OS 3.1.5 or 3.1.6, not sure about previous version. I logged a ticket with PaloAlto but looks like the bug is not important so it won't be fixed until release 4.

Re: Students, using HTTPS now on Proxies

James — Sun, 09 Jan 2011 02:43:05 GMT

Hi tontabill,

I am sure if you work with your local sales team on the issue prioritisation they will help you.

Best Regards

James

Re: Students, using HTTPS now on Proxies

djbisbey — Thu, 13 Jan 2011 09:20:17 GMT

KRboerts,

there is a PM waiting for you.

Darren

Re: Students, using HTTPS now on Proxies

MemphisBrothers — Thu, 07 Mar 2013 14:32:59 GMT

I just got into the PA this past year. Would you mind sharing how you set up the SSL Decryption with our school?

Re: Students, using HTTPS now on Proxies

HITSSEC — Thu, 07 Mar 2013 23:59:29 GMT

Try going here: https://live.paloaltonetworks.com/docs/DOC-2008

Re: Students, using HTTPS now on Proxies

ThomasConlin — Fri, 31 Jul 2020 08:57:57 GMT

For the safety of data transportation, experts advise students to use the HTTPS protocol, because any information entered using SSL is encrypted, so in case of interception, the attacker receives a random set of characters and can download your dissertation.
https://customwritingz.net