Re: [Full-disclosure] [inbox] Re: [ Capture Skype trafic ]

"Acceptable Usage Policy" is a cross-functional issue involving HR and IT.
HR tools are "Code of Conduct" and user awareness programs. IT is a
fecilitator to the HR agenda in this case. Practically in most of the cases
HR is accountable for such usages and IT can be the reponsible party to the
policy.

Cheers


On 10/30/06, Exibar <exibar@xxxxxxxxxxx> wrote:

I'm sorry, but that document outlines HOW Bluecoat can and does block
Skype.
A packet or protocol anaylizer Proxy will block anything that is NOT
conforming HTTP to travel along on port 80. Skype does not conform to
HTTP
standards (for one it's encrypted) and BlueCoat will stop it.
Yup, you can't be a moron and have every other port under the sun open
on
your network too....



"STEP 4: INSTALL SSL CONTROLS ON THE BLUE COAT SG
The Blue Coat SG appliances managing application service ports for HTTP
(80), RTSP (554), MMS
(1755), etc. will drop client connections if the packets sent do not
conform
to the appropriate
protocol. When Skype uses port 80, the protocol used is still Skype's
proprietary protocol and does
not conform to HTTP and so will be blocked. The Skype application finally
attempts to use port
443, if the SSL controls are installed (part of SGOS v4.2) these packets
will also be dropped as
there is no SSL certificate exchanged between Skype nodes. Therefore, any
attempt to establish a
Super-node connection through these service ports will be unsuccessful, as
the connection is nonconforming to standards."



> -----Original Message-----
> From: Tyop? [mailto:tyoptyop@xxxxxxxxx]
> Sent: Friday, October 27, 2006 2:19 PM
> To: Exibar; full-disclosure@xxxxxxxxxxxxxxxxx
> Subject: [inbox] Re: [Full-disclosure] [ Capture Skype trafic ]
>
>
> On 10/27/06, Exibar <exibar@xxxxxxxxxxx> wrote:
> > From: "Tyop?" <tyoptyop@xxxxxxxxx>
> > > All is in the mail's subject.
> > > I need to match this crazy-encrypted-random trafic,
> > > to destroy it (I think I'm not alone to need informations on this
> > > product).
> > > I've found some work on the BlackHats slides,
> > > but skype updates..
> > use a packet analyzer proxy.... bluecoat comes to mind as one
> that works
> > quite well...
>
>
http://www.bluecoat.com/downloads/whitepapers/BCS_controlling_skype_wp.pdf
> Bluecoat doesn't match the packets, sorry.
>
> quote:
> It is also recommended that enterprises block downloads of URLs ending
> with "skype.exe". This will prevent new Skype software from being
> downloaded to enterprise machines.
>
> This is very funny. ^-^
>
> --
> Tyop?
> "Please excuse my english."
>
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • RE: basic stateful inspection question
    ... What you are talking about is checking the packets if they are REAL http if ... http connections and point to somesort of CVP server that checks traffic ... This makes it more difficult to use port 80 through firewalls but if you can ...
    (Security-Basics)
  • Re: Not able to allow skype
    ... week ago I saw in the monitoring that it's trying to go over port 33033. ... Sometimes you are able to sign in to skype but not to call. ... will have trouble then connecting from home with a proxy filled in. ... Can it be something to do with the webproxy filter which is on for http ...
    (microsoft.public.isa)
  • Re: Dos attacks
    ... would include a certain amount of "probing" by other systems... ... and samples of the packets. ... A ping followed immediately by a port ... HTTP requests could be someone looking for unknown web sites, ...
    (comp.security.firewalls)
  • Re: Etherreal not capturing calls to localhost
    ... no packets are being seen or captured. ... I think the MS SOAP toolkit has a tracing utility where you set up a local proxy to which you direct your requests which are then traced and forwarded to the real address so you could e.g. set up that proxy for HTTP on port 8080 and have the normal web services for HTTP on port 80. ...
    (microsoft.public.dotnet.xml)
  • Re: Odd Ports Being Allowed
    ... I just wish the Web Proxy wouldn't be so ... intrusive with the packets and just automatically detect and allow HTTP out. ... > You can make a deny rule that denies access on the external sites on port ...
    (microsoft.public.isa)