Web blocking software can be easily bypasse

 

reported by securityteam

Web blocking software generally comes in three forms: an installation on the user's computer, using a proxy that
filters URLs and as a module that integrates with a Firewall.

 

Local Installation

The local installation is the weakest of those three forms. It is generally hard to limit users from accessing their
local computer. Even FoolProof, which is a software that its sole purpose is to limit users from free access to their
local computer, can be easily overcome (see our article: Can FoolProof block malicious users?)
PeaceFire (www.peacefire.org) lists simple ways of disabling the most common web blocking software. Here is a
short list of how to disable some of those applications:

CYBERsitter '97
Rename the file c:\windows\system\wsock32.dll to something like wsock32.bak
Rename the file c:\windows\system\wsockc97.dll to wsock32.dll

The following program does not change the system settings but simply displays the master password:
http://www.fortunecity.se/kista/virus/9/cs97hack.zip

Cyber Patrol
A program called CPCrack cracks the master password and displays it on the screen:

Other ways of disabling Cyber Patrol:
* rename the files c:\patrol\cyber.bin and c:\patrol\cyber.not
* create an empty file called cyber.not in the cyber patrol directory, restart windows and restart windows again.
After the second time CyberPatrol will be disabled.
* Remove CyberPatrol from windows startup (by removing it from win.ini, the start menu and the registry)
* This program will temporarily disable Cyber Patrol: http://www.glr.com/cypatrol.zip

SurfWatch
An application called SurfPass will replace the master password with another known password. This program can
also change the password back to the original to make itself un-noticed:

Net Nanny
* Kill the application by doing CTRL+ALT+DELETE, choosing Wnldr32 (on some versions the task is called
OCRAWARE) and clicking "end task".

Proxy

Another method used by web blocking software is going through a proxy which filters the incoming URLs. A
proxy is better than a local installation, because the user does not have full access to it.
However many anti-censorship are trying to fight this method of blocking by supplying an "anti-proxies". These
are special web sites that allow a user to type in a URL, and receive the content of that URL, without actually
doing the request for the URL. This "fools" the proxy filtering mechanism, since the user is communicating with
an "allowed" site. A well-known examples of an "anti-proxy" service is the anonymizer:


Another service that helps to bypass proxy filtering, is the web-page-by-mail service. Sending mail to:
web@glr.com with the first line of the message being the requested URL, results in a reply containing the wanted
web page.

 

Back--Home