Home page logo

basics logo Security Basics mailing list archives

Re: Internet Adult (illegal) Content Filtering - request for opinion
From: girardot <girardot () mac com>
Date: Wed, 27 Nov 2002 15:47:35 -0500

youch. stay away from closed source security products if you can. esp the
super secret snake oil varity.

have a look at dansguardian. it will probably do 99% of what you need. and
about the only OS it doesn't run on is that security nightmare windows


here is a more straight forward description of what a content filter does
from the DG website:

"It filters the actual content of pages based on many methods including
phrase matching, PICS filtering and URL filtering. It does not purely filter
based on a banned list of sites.
Uses a very intelligent algorithm to match phrases in web pages mixed in
with HTML code and white space.
It has the ability to switch off filtering for specified sites, parts of
sites, browser IPs and usernames.
Uses an advanced phrase weighting system to reduce over or under blocking.
Can filter sites using the PICS labeling system.
Can filter according to MIME type and file extension.
Can filter according to URLs including Regular Expression URLs.
URL filtering is compatible with squidGuard black lists.
The URL filtering is able to filter https requests.
Can block specified source IPs and usernames.
Can block or limit web uploading
Big5, Unicode and top-bit set characters can be used in search phrases.
Can work in a 'whitelist' mode where all sites except those listed are
Can block all IP based URLs.
Is able to block sites when users try using the IP address of the site

its integrated with a few firewall products as well and you can buy
commercial support for installation, training and maintenence.
and works like a charm with a squid proxy for added benefits of local

if you like it and it works for you please be sure to take the money you
save not buying a commerical product and be sure to donate to the DG author,
he deserves it for helping out so many schools and libraries (what it was
first designed for).

most of the made up buzzword like stuff below would probably apply to DG as
well. and it doesnt make it just look like the browser crashed.

i have nothing to do with DG, just a very happy user.

----- Original Message -----
From: <Karmil () zadco co ae>
To: <security-basics () securityfocus com>
Sent: Wednesday, November 27, 2002 12:52 AM
Subject: Internet Adult (illegal) Content Filtering - request for opinion

Hi All,

Internet Illegal content viewing has always been an issue for corporate
organisations.  Even a properly configured proxy server will not deny
someone receiving porn content through a web based email account.
Eventually, such content viewing during office hours leads to decrease in
productivity. :)

In searching for a solution to such a problem, I recently came across a
software called "iCom Stealth".  However,  intelligence regarding both
software and its developing organisation is obscure.  No address or
details exist for that organisation.  Besides, this software is free as
organisation believes "that this kind of software should be free."

And since I am not very proficient at reverse engineering,  it's quite
difficult for me to determine what's going on behind the code.

The software is very easy to install and does NOT allow for "ANY" option
all.  You just have to install it.  Under W2k, it runs a service named
"thdetr.exe" which uses approximately 4MB of RAM.  In their FAQ, this
organisation has included the following:

"Our filter relies on our unique artificial intelligence system,
composed of the IPR (Intelligent Pattern Recognition) engine, and the AMS
(Application Monitoring System).  Just blocking a domain is not enough if
the user knows how to mask or hide the blocked data.  That's why we opted
for this solution.  Our software will NEVER connect to any site, and will
not gather and/or disclose any kind of personal information."

This is how the software  works.  Whenever an illegal content is being
viewed (either from a site or a web-based email site), the content starts
load in the Internet Explorer window but IE closes after 1 or 2 seconds.
you try to access the same site again, the same thing happens.  The page
loads and then the IE window closes.  I have not tested this software with
any other browser apart from IE.  Please note that this software also
if obscene language is used on MIRC and yahoo messenger.

The software is really effective, but as i mentioned, you never know when
some malicious code is running in the background.

Here's the link to their site.

I am generally very prudent in using freeware, and i tend to extensively
research on the product and organisation and seeking third party opinions
before using it.  But this one, though it is very effective, is at the
time very obscure.

Does anyone have any idea/opinion about this software?


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]