[K12OSN] Stopping web messenger

[Dan Young]

Todd O'Bryan wrote:
> Some of my students have figured out how to set up their own web proxies
> on their home machines. Not very hard if your ISP gives you a static IP
> address. My guess is that these would be almost impossible to stop
> completely, but it sure would be nice to know what strategies people use
> for these kinds of problems.

Some proxies are obscuring sub-URLs, using myspace as an example:
zlfcnpr   - myspace; ROT13
bXlzcGFjZ - myspace; base64, not padded*
15c3BhY2 - myspace; base64, padded w/ 1 char*
teXNwYWNl - myspace; base64, padded w/ 2 char*

This should reveal those:
egrep '(zlfcnpr|bXlzcGFjZ|15c3BhY2|teXNwYWNl)' \
/var/log/squid/access.log

* The base64 encoded versions are approximate; they may match on
'myspacf', etc. You can use openssl to play around with encoding:
[dyoung at ltsp ~]$ echo myspace | openssl base64
bXlzcGFjZQo=
[dyoung at ltsp ~]$ echo myspacea | openssl base64
bXlzcGFjZWEK
[dyoung at ltsp ~]$ echo amyspacea | openssl base64
YW15c3BhY2VhCg==
[dyoung at ltsp ~]$ echo /myspace/ | openssl base64
L215c3BhY2UvCg==

Or decoding:
[dyoung at ltsp ~]$ echo aHR0cDovL211c2ljcGxheWVyLm15c3BhY2UuY29t | \
> openssl base64 -d; echo
http://musicplayer.myspace.com

-- 
Dan Young <dan_young at mesd.k12.or.us>
Multnomah ESD - Technology Services
503-257-1562