Vendor claims to nix URL-bypassing sites

By Dave Nixon

Proxy blocking company 8e6 has stated that its software can now curtail the proxy scripts that have lately swamped the Internet as a way of bypassing URL blocking systems.

Such scripts give non-expert users a method to evade the conventional web URL filtering systems employed by government, libraries, universities and companies by initiating private web pages running applications that circumvent such filtering.

Anybody using such sites as a ‘launchpad’ will not be picked up by many URL filters, permitting them to namelessly reach any website on the Internet, including file sharing and porn sites, or just to open unauthorised IM or P2P sessions.

According to the company, there are a quantity of such scripts out there, including PHProxy, Proxify, Circumventor and CGIProxy.

How does 8e6 manage to accomplish what many others have failed? It’s all in the ‘proxy pattern detection’, the company says, a verbose way of saying that its software works out when port 80 traffic is heading for an HTTPS or SSL session or just doesn’t exist on a whitelist of approved proxies.

The claim comes only days after a contentious test of web filtering products, the so-called ‘Deep Throat Fight Club’ held at the RSA Show by Open Source vendor Untangle was criticised by one vendor, Watchguard, for not properly assessing proxy bypass techniques.

The test had established that most web URL filtering systems worked virtually as advertised, despite the fact that an emergent band of Internet users are known to bypass these using script-based proxy websites such as the ones referenced by 8e6.

8e6 claims to be the only company capable of blocking such sites, which is not 100% true. Other vendors, including Watchguard, are recognized to utilize proxy blocking to some extent, but don’t seem to have picked up on the growing importance of the issue to the extent of explaining how they go about it.

The company re-launched itself in the UK in January with an attempt to court SurfControl customers wary of the latter’s takeover by security giant Websense.