Ultrasurf
This issue has been solved. See solution.
mon_raralio
May 20th, 2009
Has anyone tried and suceeded to block/delete/quarantine Ultrasurf?
Has anyone tried and suceeded to block/delete/quarantine Ultrasurf?
Ultrasurf... Yes this
Ultrasurf... Yes this executable file is used by clients to bypass policies in getting to non business related sites. They could be detected as bloodhound sonar using Truscan Proactive threat scan...
Some tends to rename the file so that they could use it again... but could still be seen by the AV.
Any help in blocking it would be very usefull.
thanks.
Nel Ramos
Signing up to see a solution.
Signing up to see a solution.
Re
I think we block executable files via GPO, but just rename it will run again. How about submitting this to Symantec?
Yes Paul M... Blocking
Yes Paul M...
Blocking executable files via GPO is only good if the clients would not rename the file...
They always rename it... that is a real problem... :(
I hope we could resolve it hear in the forums first..
if not then we might just get a ticket from Symantec...
Thanks...
Nel Ramos
I have an idea. :D
How about testing SEP on VNC first. I'm also getting alerts from users with WinVNC installed. They're tagged as Commercial.Apps
But unlike UltraSurf, it needs to be installed.
Re
Nel, I believe you found this application to be suspicous (virus) I suggest you submit it to Symantec for Analysis.
Okay, I submitted the file
Okay, I submitted the file (version 94) to gold support. We'll see what they say. It's not really a virus, so I stated that I wanted SEP to be deny this file from running.
Well, just got a reply, they say the file is clean.
Re
Hi Rick, the file is tagged as proxy avoidance.. this could be a risk if the one using it will use it for personal gain or something.
Hi Paul,This is the text
Hi Paul,
This is the text included with my submission:
This file is called Ultrasurf. Its an anonymous proxy that the SEP firewall cannot stop. Apparantly it creates a local port 9666 on localhost and listens. I think it creates a tunnel out of port 443 so firewalls cant block it. Please tell me how to prevent this file from running with SEP MR4 MP2
Re
I see, what if we request it to be treated as a virus and get its file signature so that It will not work. But this could lead a long discussion with Symantec.
I just received a report from my officemate that sometimes it can be detected by SEP as Bloodhound.Sonar.1 but I guess this depends on the websites they visit.
I if the environment has a proxy as long as the proxy is set to be transparent there could be a ways to block it. I currently testing it my colleges.
Hi Paul, SEP still has not
Hi Paul,
SEP still has not reported anything on this executable.
Unfortunately, in my environment, the shared computers that use a proxy (not transparent) are defined to use a proxy by a GPO. I don't limit all of my users (especially upper management) on web content from my hardware firewall/web proxy. Shared computers, I make them go through a hardware proxy for web content restrictions.
Or
We could try to block their servers, but we haven't captured all of it's servers. What about putting localhost:9666 on the restricted zone as a policy?
In my searches, there are too
In my searches, there are too many servers to block and more added per day.
We
just tried it on our RAS access, our RAS access is only for emails.. Ultrasurf doesn't work.. hehehe
Re
What about creating whitelist of authorized HTTPS sites? (just an idea)
Hi Paul, A whitelist of HTTPS
Hi Paul,
A whitelist of HTTPS sites would probably be too hard to implement in my environment as I don't know what secure sites my shared computers visit (these shared computers are the only ones using my hardware appliance web proxy) approximately 60% of my 250 computers. Yes it's small but still hard too track of where they are surfing secured sites.
Well, SEP is not reporting
Well, SEP is not reporting anything about this executable. I know my hardware based firewall supports blocking this application, but I would have to do a major upgrade to the OS (Astaro). I came across some internet sites talking about blocking it with GPO's, but my tests have not blocked it at all (I did manage to get it into the Internet Explorer's Restricted zone, but you really can't stop it there either).
I was hoping we could use Application Control to block it, but unless you can do it by the hash value, I don't see that as an option since you can rename the executible to anyting and it will still run.
Re
Yah, we are still doing some tests, will update this thread for any updates. Thanks!
In my test lab I am running
In my test lab I am running Ultrasurf, I am hitting IP address 65.49.2.114 through port 443. You can block all traffic to this IP address or an IP range. I know this won't keep the application from running, but it will stop all traffic from going through Ultrasurf.
Thomas
.
If you open Ultrasurf, you have at least 3 options for which servers to use.
An additional info: When using firefox with Ultrasurf, you need to configure a proxy as 127.0.0.1 (localhost) with port 443.
The admins here tried blocking it, but some applications used for work also stopped functioning.
More testing
Well, seeing as how I have Learning applications enabled in my communication settings for all groups, I dug around and found the app in question (I had renamed it to test.exe) and SEP sees it as a 0 byte file with a very old time/date stamp and no fingerprint value:
Wierd
That is wierd. A file with NULL values.
A little off topic: Will there be a noticeable difference in performance with that feature enabled?
Although Ultrasurf is not
Although Ultrasurf is not treated as a virus but it makes security breeches for virus to proliferate...
Symantec better have this apps blacklisted not by its name but by its characteristics since clients just renames it to be undetected...
Since we could capture it thru heuristic scanning and all instances in our company had detected it thru the TruScan Proactive Threat Scan... Symantec could find a way to restrict it from executing..
Hopeful and thanks.
Nel Ramos
Re
Hi Rick wat was the fingerprint before you rename it?
I don't know, I renamed it
I don't know, I renamed it before I ran it. Would it have made a difference since renaming it apparently wipes out the fingerprint (or wouldn't a new fingerprint be generated by SEP)?
Re
I see that what I am after.. thanks for the info..
Paul
Paul,
Don't leave us in the dark! :-) Spent most of the day googling this software and only found a handfull of products able to detect this including an AS/AV company. None of my GPO modifications helped either (tried many). Let me know if I can help further.
Re
I am also in the dark Sir Rick (heheheeh) , we are still testing how to block it, dont worry we are compiling all of the methods that we are using and will post here..
But I think the solution is when the software is reqesting a connectiong from port 9666 to port 443, it should be routed to a dummy server. (just a thought , cannot test yet)
$0.02
How do you propose a dummy server to be setup? Companies, I'm sure, won't be willing to shell out additional funds for the licensing of setting up a dummy server just for the sake of one application. They'd rather tell the IT team to scour every workstation and delete the file, even if the IT would have to do it everyday, IMHO.
Re
Btw, has anyone tried ultrasurf on a websense proxy environment?
Tried it in Websense
I just tried this in websense and got some mixed results. it seems like if you have a category set with the continue option it overides it but if you have a hard block set it can not get through.
example here due to the nature of our business we have the continue option set on youtube and I was able to go to that site with no warning about makeing sure it was business related.
playboy though we hard block and I could not get there I also tried several other porn sites and could not get to them.
good news in my environment was that I only show 2 users with it on their machines.
Maybe I missed something here
Maybe I missed something here by why can you not just use application control in SEP to block the .exe using the MD5? The latest version I downloaded has a value of: 11BC744801B516D0B84FBA5850EC8789 I guess you would then have a to have all older versions to get the MD5 from?
Sutton
I was going to suggest the
I was going to suggest the same thing: why not to fingerprint it and block it using application control?
Additionally, use proxy so no straight HTTP/S is allowed outbound.
@mon_raralio: since we
@mon_raralio: since we already have resource to wipe ultrasurf, it is an easier option rather than buy hardware although this option would be labor intensive...
Eventhough we wipe it... It does replicate after a while...
thanks...
Nel Ramos
We usually detect users as
We usually detect users as bloodhound sonar...
but the ussual problem is them renaming the apps...
cheers..
Re
A dummy server can be anything, im not proposing it be online.. could be a virtaul also (This is just an idea) as there no clear way of blocking this app.
Re
Hi i have searched the net i have read that using windows publisher security, we can block this software via windows.
great paul. please post the
great paul.
please post the link if it is alright.
thanks.
Nel Ramos
Re
Thanks, I will post procedures as soon as our team tests it.
May I know the latest
May I know the latest Ultrasurf version in the market?
thanks.
Currently it's at 9.4 and
Currently it's at 9.4 and users can still use those that are at least ver 9.1. And it's not "in the market" , because it's a freeware.
"
UltraSurf is a free software which enables users inside countries with heavy Internet censorship to visit any public web sites in the world safely and freely. Users in countries without internet censorship also use it to protect their internet privacy and security.
"
It's true about their privacy and security, because the websites visited while using this application doesn't show up in the history.
Are you planning on using this application? ;)
Thank Mon... I might had
Thank Mon...
I might had downloaded the 89 version because it would not operate anymore...
We shall test the 9.4...
thanks
Here's something to check out...
http://blog.zemana.com/2009/01/zemana-anti-ultrasu...
Sutton
Looks promising. But with the
Looks promising. But with the nature of UltraSurf being open source. It's development would be faster than the one used to block it.
That seems like a very good
That seems like a very good source. Thanks for sharing it!
dog training
Blocked
Using the checksum utility and getting the MD5 and adding that into application and device control successfully blocks Ultrasurf from running even when you rename the executable. Now I need to get the older version's MD5:
Congrats Rick. Hopefully
Congrats Rick. Hopefully everyone else finds this very useful. Maybe they will even help you find the older versions MD5
: )
Please don't forget to mark your thread solved with whatever answer helped you : )
MD5 of Ultrasurf
ver 9.4: 11bc744801b516d0b84fba5850ec8789
ver 8.9: f556271e1338dfc224cbebf6fe8f8eae
How can we get this so
How can we get this so TrueScan will detect this application like it does for VNC and LogMeIn so we can apply an action on it?
@delifeath: thanks.. we are
@delifeath: thanks.. we are now testing it... hope this works to stop internet junkies from exploiting the web... give you the test results later...
Nel Ramos
I am also into it... would
I am also into it...
would SEP be detecting this in heuristics?
Not only ultrasurf is
Not only ultrasurf is detected as bloddhound sonar in SEP.
would it also block other applications that have the same properties?
I would like to know it before I use this...
lastly is this recommended by symantec?
many thanks all...
I'm not sure about your first
I'm not sure about your first sentence. Ultrasurf and possibly other unknown applications that allows the user to bypass security and filtering is considered as a possible threat. This may be used to improve productivity or introduce more problems.
Bloodhound is a heuristic scanning developed by Symantec to try and detect unknown threats. It's efficiency is disscussed in another thread.
Symantec hasn't made any recommendations whether to block this application or not, meaning, it hasn't been added to the CAL event detection - this report commercial applications/tools like remote desktop, password management, installer utilities.
@RickJDS: hi... would it slow
@RickJDS: hi... would it slow the SEP process if we activate the learn mode to detect Ultrasurf if we have 10,000 computers?
Thanks...
Nel Ramos
http://www.ultrareach.com/download_en.htm
The MD5 for the latest versions is listed on their website. They also include the md5 on the zip. Their site would be a good place to check periodically to look for newer versions and the latest md5.
http://www.ultrareach.com - It's a noble cause, just a pain in the &$# for us admins here in the land of the free.
Also, here are two md5s for two earlier versions of ultrasurf:
f556271e1338dfc224cbebf6fe8f8eae - Not sure of version number
4e3a66482ef96368251d91b4f5ae0fda - Looks like version 8.8
Hi, I'm not familiar with the
Hi, I'm not familiar with the MD5s. Are they unique to everything being made?
I'm not against the use of Ultrasurf. It's just that some users don't understand the security issues it poses when used inside their company. They visit sites with malicious code and then...
Version 9.2
4b498bcac14da546f420cd08bae1894b - MD5 for version 9.2
I'm adding these to my app/device control rule as I find them on the web. Blocks each and every version as I add them. Works like a charm!
Re
Info on MD5
http://en.wikipedia.org/wiki/MD5
Hi Rick, have you tried the changing the Actions of the Application rule to log it? And also, ultrasurf is being detected by SEP and sending us notifications that it detected as BLOODHOUND .sonar
Why would something like this
Why would something like this is not being detected via signature? Has anyone tried to submit UltraSurf to Symantec for idnetification and detection?
Here's Symantec's response
Here's Symantec's response after I submitted the file:
We have analyzed your submission. The following is a report of our findings for each file you have submitted:
filename: u94.zip
machine: Machine
result: See the developer notes
filename: u94.exe
machine: Machine
result: This file is clean
Customer notes:
This is an Ultrasurf application that allows users to open a rogue proxy server on their machines and connect to other proxies via https to bypass all local outbound connection control measures.
Developer notes:
u94.zip is a container file of type ZIP
u94.exe is a clean file This file is contained by u94.zip
Paul
Hi Paul,
I am logging it (see the screen shot above it says under the launch process attempt: Block (log)). I have confirmed that SEP 11.0.4014.26 with AV/AS definitions of 6/1/2009 r3, PTP definitions of 6/1/2009 r20 and NTP definitions of 5/19/2009 r2 is NOT detecting Ultrasurf version 9.4 as anything. I have the u94.exe on the desktop and right clicking on it and clicking on scan for viruses does not find anything.
Dimitri, I have submitted this to Symantec (read my post earlier) and the only response I got was the file was clean.
Also, just to note, the MD5 reported by the Ultrareach/wujie website is not the same as what is reported by the checksum utility provided with SEP.
Dperfekgent, I don't know what kind of performance hit the SEP client would take by enabling the learn application process, hopefully a Symantec employee can address this. SEP is not detecting this as anything right now so it's pointless to enable the learn application process to detect it. Users can rename the executable to anything and you would not know what file name to block.
Errrrrr
Uh, the same exact fingerprint you have listed in your attached pic is the same exact one that is listed on the site. It is also the same exact one I pull from version 9.4 when I scan it. It also prevents version 9.4 from running when I add it to my block list. ??
11bc744801b516d0b84fba5850ec8789 - MD5 for version 9.4 - Listed on http://www.ultrareach.com as the version's MD5 and is also the result of Symantec's checksum ultility scan of the file.
b6d9db95e947705eeaa98544de5647ce - Fingerprint for version 8.7
Errrrrr??????
SysAdmin1979,
Again, I should be more clear in my posts. The MD5 I was referring to was the one listed when you actually run the application and it opens Internet Explorer listed in the picture below (yes that's the MD5 for the zip file):
The best way to do this is
The best way to do this is via SEP's firewall policy. Create a rule where host source is ANY and destination is 127.0.0.1 and under services source is ANY and destination is TCP/9996.
Other methods are not as reliable as Rick mentioned, as MD5/fingerprint and file name are easily bypassed by someone who knows what they're doing.
Ahh
Specificity
http://www.ultrareach.com/download_en.htm
Re
Have you tested this dimitri?
Yep, works like a champ.
Yep, works like a champ. Application still loads but it is not capable to launch IE and just sits there, doing nothing, asking to make sure you're connected to the Internet.
@SysAdmin1979:
@SysAdmin1979: f556271e1338dfc224cbebf6fe8f8eae is the MD5 of U89.exe.
This was the first ultrasurf variant that we had encountered before the client updated to the Ultra surf 9.4...
Nel Ramos
MD5 or fingerprint is not
MD5 or fingerprint is not going to work all the time. Just like with signatures, you are always behind unless you can be 110% sure you've covered ALL possible versions. That's why you want to block this on the endpoint and on the network layer. Blocking it on the endpoint is done via fwall rule I described above. Blocking it on the network layer is a bit more complicated but I'm working on that. You will need a smart firewall or NIPS appliance that can do packet inspection and SSL reassembly to achieve this, or you will need to keep a list of all Ultrasoft proxy networks and blacklist them that way, which is a major pain in the ass.
It would be nice if Symantec released a signature for this, or at least gave us an option to classify UltraSurf as an unwanted proxy application, the way McAfee and Sophos does. This way you could block it on the endpoint once and for all and not load a separate fwall rule for this particular threat.
We're testing this MD5
We're testing this MD5 today.
SEPM > Clients > Ploicies > Application and Device Control Policy
Enabled: Block applications from running.
Added the MD5 in the Launch Process Attempts for versions 89 and 94 of Ultrasurf.
Add...
Match file fingerprint.
Woohoo!!!
We've successfully prevented the user from using the application:
SEPM > Clients > Policies > Application and Device Control Policy
Enabled: Block applications from running.
Added the MD5 in the Launch Process Attempts for versions 89 and 94 of Ultrasurf.
Add...
Match file fingerprint. Added these MD5 values
md5 for version 94: 11bc744801b516d0b84fba5850ec8789
md5 for version 89: f556271e1338dfc224cbebf6fe8f8eae
Set the action to Terminate the Process.
Note: Setting it to block doesn't do anything.
Success also on our
Success also on our part...
Both U89 and U94 that is being used by clients are now terminated upon startup of execution.
We are also finding the fingprint of the other apps that needs blocking....
They are not happy but we are!
Many thanks to RickJDS for the resolution!
thanks...
Nel Ramos
Terminate vs Blocked
Block works better for me. The user is given an error message "the handle is invalid". I'm hoping they think they have a corrupt file.
Terminate does the job well too, but the users will probably try to keep running the executable since they don't get a notification unless you enable it. I haven't tested enabling the notification through the policy (would it be a Symantec pop up windows or a normal Windows pop up?).
Glad it works for you both.
It was a Symantec
It was a Symantec notification near the System Tray. I think either way we use-block or terminate, as long as the application is not being used, we can now have a little breather.
I only brought it up since
I only brought it up since you said "Note: Setting it to block doesn't do anything." I just want to make sure that people know setting it to "block" actually does work. Thanks for clarifying the type of notification, I appreciate it.
Sorry about that. Maybe the
Sorry about that. Maybe the settings hasn't reached the clients when we did our test.
On the plus side - terminating the MD5 also terminates the Explorer.exe which is the process that starts the executable - that's how I understood the log tables in SEPM. No worries here since it restarts with all previous open folders now closed. This would make the end user think that the proxy they are using makes Windows crash. They will either admit to using that and get a solution or hide it from you. Either way, you'll get a well deserved rest or a few [evil] laughs.
Mon-raralio,That's
Mon-raralio,
That's intersting that in your tests, explorer.exe was terminated. In my tests with the action set to terminate, explorer.exe was not affected at all. The u94.exe application simply did nothing when you double clicked on it (notifications were not enabled by default so no pop up notifications appeared), but the Monitor / Logs / Application and Device control log showed that u94.exe was attempted to run and terminated.
My test client was 32-bit Windows XP with SP3 running MR4 MP1A. Thanks for sharing, I think we need to test this solution further as maybe you had a different variant of u94.exe than I did.
When testing, I ensured that after I changed the Application and Device Control Policy, that I issued the Update Policy on the client and checked the policy version to ensure it had the date/time stamp of my last change and then tested any changes I applied.
I agree that we can relax now that we have a file signature solution in place. I would really like a better solution via TruScan though and hope there's a Symantec Employee following this thread that will submit this suggestion so we can classify this application.
The only difference I can
The only difference I can recall is that you set your policy to block while I set mine to terminate. So, your file did not execute while mine did but was abruptly ended. Maybe we'll try the block action when deploying the policy to other clients. And maybe someone could list down all the versions we've missed. I know a version 0.92 or 0.91 was used here.
Versions I have
8.7 or u87 = b6d9db95e947705eeaa98544de5647ce
8.8 or u88 = 4e3a66482ef96368251d91b4f5ae0fda
9.2 or u92 = 4b498bcac14da546f420cd08bae1894b
9.4 or u94 = 11bc744801b516d0b84fba5850ec8789
Unknown at this time to me = f556271e1338dfc224cbebf6fe8f8eae - Looks like it's 8.9 - Thanks Nel Ramos!
What versions we are missing...... No idea
I wonder if they would respond to an email request for this information?
info@ultrareach.com
So now that everyone is
So now that everyone is blocking Ultrasurf, what about Tor? Same concept, but fwall policy blocking traffic to localhost won't work since the port is dynamic. Anyone figured it out on a network layer, versus chasing down versions and checksums?
Re
Hi Team, have you tried renaming the file then run the process again? Hi dimitri, we are testing it to block via network side, still no progress.. will update this thread as soon as we get positive results.
Three more
8.6 or u86 = f53597f07ad9425d64a1eccd440e7b54
9.0 or u90 = faf9418cc0d4d4ff0a78f61283a9d29a
9.1 or u91 = 13f51c8c42e44bcb459c62e1c0e0e93b
I'm going to get to Tor eventually
Besides Tor, there are about 7 others that come up on a quick websearch.
Is there a group policy that can prevent users from configuring their proxy settings?
@Paul Mapacpac
Yes, i've tried renaming the file and it is still blocked via the fingerprint method.
@Dimitri - I like your suggestion for blocking it via the firewall with port 9996, but when i test it here i'm seeing ultrasurf configure via port 9666. Has anyone else seen anything other than these two ports? I wonder if it uses several different ports, or whether I'm just seeing it wrong.
That was a typo,
That was a typo, sorry. TCP/9666 is the port it uses, just like you said.
Tor, on the other hand has this value configurable, so blocking *just* the default port it comes with (TCP/8118) is not very useful.
Re
Hi SysAdmin I believe it is only using port 9666 of the localhost. Try to use firefox and it will only work if you put 127.0.0.1(address) and 9666(port) after running ultrasurf.
Now I'm curious as to how/if
Now I'm curious as to how/if anyone is blocking the Firefox snap-ins for either Ultrasurf or Tor. SEP can only block (and fingerprint) EXEs to be used in application execution control rules, and file access rule that prevents access to actual XPI doesn't seem to do anything. I've tested few different combinations but every time Firefox loads plug-in and provides access to either Tor or UltraSurf network.
Thoughts?
Nevermind, I figured out how
Nevermind, I figured out how to block Firefox plug-ins for both Tor and UltraSurf.
Blocking Firefox and torrents.
Please tell us how you did it. Thanks.
dimitri, Care to share how
dimitri,
Care to share how you were able to block the plug-ins?
Sorry, late night brain
Sorry, late night brain freeze yesterday. The way to do it is this:
- Download (don't install) Firefox add-ons for both Tor and UltraSurf, they will be in XPI format.
- Extract them to local directory, they're nothing but archives. WinRAR didn't understand them, but 7Zip worked like a champ.
- Examine files in the extracted directories, for Tor I blocked torbutton*.* and few other particular ones, for UltraSurf it was wj.jar. Make sure you don't block something legitimate that breaks installation of plugins for Firefox in genereal.
- Create file access control rule so Firefox and Explorer.exe can't access these files. Blocking Explorer.exe's access will ensure that user doesn't just rename the file and bypass your rule altogether.
- Apply policy and test. You will not be able to load these add-ons or uninstall them, however you can disable them in Firefox which will ensure it loads normally.
That's it!
Would you like to reply?
Login or Register to post your comment.