Ultrasurf Block on R81.20

[VIKAS_SINGH]

Hi Team,

I m trying to block ultrasurf but its not getting , when check logs its ultrasurf is block but i am to acceess.

[emmap]

I don't know that being able to open its page on the chrome web store is a valid test. 

[VIKAS_SINGH]

yes, i am able to add chrome extension and able to use facebook which we blocked.

[Lesley]

Traffic is allowed towards the chrome store not the ultrasurf website. If you want to manage web browser extensions it should be done on GPO level (AD). Or block the chrome store, but then you block all extensions

If user installs extension does this extension work? If so, do you run HTTPS inspection? Or you have categorize https websites enabled? 

https://community.checkpoint.com/t5/Management/Difference-between-HTTPS-Inspection-and-Categorize-HT...

[VIKAS_SINGH]

hi,

Ultrasurf is vpn proxy which used to bypass the firewall to use block website, so when we add ultrasurf on ext it will allow you to access all blocked content.

Go through below link

Solved: Best Practices Against Ultrasurf - Check Point CheckMates

[Lesley]

Let me change my questions, why would you let users to install any extension what they want?

Now it is Ultrasurf next week something else. I think you should start with the basic and do something with GPO. There are malicious extension for example: https://www.kaspersky.com/blog/dangerous-browser-extensions-2023/50059/

[VIKAS_SINGH]

we are doing setup for University where students will BYOD and we don't have control over them, so need to block what possibility we found .

[the_rock]

What was already suggested is probably your best bet.

Andy

[Lesley]

So no https inspection. That will be a pain. Is categorize https websites enabled in Smart Console? 

[the_rock]

Were you able to fix it?

[the_rock]

What @Lesley said is 100% correct. I will test this in my lab tomorrow, since I have ssl inspection enabled, but I doubt it will be any different.

Andy

[PhoneBoy]

Allowing users to install random browser extensions is considered poor practice.

Having said that, to fully block Ultrasurf, you need to make sure you have a strict outbound policy (only specific web ports allowed) and use HTTPS Inspection + App Control.
Ultrasurf is also known to be very evasive and we’ve had to adjust the signature for it in the past.