Accessing Blocked Websites.

[Flyingpony]

Now you can access all blocked URLs from work/school, at least until this URL gets blocked by your admin person :shutup:

http://www.a-bug.com/

Enjoy.

Edit: Obviously if it's blocked then going around it could get you into more hot water. Use with caution.

[Limb]

Thanks for that Flying pony. I'm off to have a play :) (Now i can be one step ahead of my employies) sweet!!

[Biohazard]

Or you can buy a web dongle, which is usb and allows you to search the internet direct from the device and not the PC.

This is the safest way to use shared machines (internet cafes etc), Oh and surf at work :blip:

[Colapop]

Tardme at work - cool! (of course all the techy kiddies here say "Oh yeah that's nothing new..."
Whatever! I like it.

[Lias]

Just to present the flipside of this..

For what its worth, be careful using such sites to get past corporate firewalls. In my place of employment using external anonymizers/proxies to bypass our list of blocked sites is a serious breach of IT policy (about 1 notch short of surfing porn). Getting caught here is likely (I know, cos I check the logs :nono: ) and first offense is a permanent loss of internet access.

Definitly worth getting a copy of your employers policy on this matter (Often called Network use Policy, Acceptable Use Policy, or something similar)

[Swoop]

Definitly worth getting a copy of your employers policy on this matter (Often called Network use Policy, Acceptable Use Policy, or something similar)
My work has something. I tried to access the file they mentioned that contains some such policy, but the file "dosen't exist" or something. Good news then... no policy!!!:doobey:

[Sniper]

Just to present the flipside of this..

For what its worth, be careful using such sites to get past corporate firewalls. In my place of employment using external anonymizers/proxies to bypass our list of blocked sites is a serious breach of IT policy (about 1 notch short of surfing porn). Getting caught here is likely (I know, cos I check the logs :nono: ) and first offense is a permanent loss of internet access.

Definitly worth getting a copy of your employers policy on this matter (Often called Network use Policy, Acceptable Use Policy, or something similar)

I second what Lias said. And if by some miracle you manage to get away with it, the IT guys will make your life a living hell.

[saul]

Yep as an older person I would issue caution as well:blip:

[Ixion]

My work has something. I tried to access the file they mentioned that contains some such policy, but the file "dosen't exist" or something. Good news then... no policy!!!:doobey:

Not at all. You clearly have an experienced sysadmin. The policy exists. No-one , except the sysadmin, knows what is in it. But nonetheless you must comply with it. This is exactly as it should be.

When you do not so comply the sysadmin will draw your noncompliance to your attention. And, in the absence of exonerating factors, you will be punished. What constitutes an exonerating factor is up to the sysadmin. Beer is always an exonerating factor . Try Speights, sysadmins are always people of exquisite taste and discrimination.

What would be the point of having a policy if everyone knew what it was ?

BTW you have also clearly breached the policy on file access. Trying to hack the system , accessing files that do not exist eh? Best go out to the liquor store right now.

[GR81]

or www.hidemyass.com or www.provacy.com ;)

there are heaps of annonymous brower sites out there

[Biohazard]

The best way to get around IT dept (sorry chaps) is this Secure surf (http://www.securesurfer.co.nz), have me order in already :blip:

[Cookie]

I would be a careful about falling into a false sense of security about devices like the "MyPrivateStick" (or "privacy" software as well for that matter).

I assume whatever data you are accessing (or sending) with the software on the device is passing through the computer's memory and therefore, stands a fair chance of ending up in unallocated space or slack space on the hard disk of the host machine.

I also don't think that that device will be sufficient to hide your activities from the network guys like Lias and co.

Also, be aware of what crap gets stored in the registry when you use that thing. I doubt it functions perfectly without leaving something behind, no matter how small.

Also, attempts to hide tracks, actually just make the computer forensic and network guys much more curious. :yes:

Under certain conditions - such as evidence of suspected theft of intellectual property (a video from the light above your desk of you using your usb thingy should do it) your boss can get a civil court order for Barristers and computer forensics specialists to seize your home computer gear and turn your house upside down.

I've done a stint in computer forensics so I am not completely talking out my arse here - no more than usual anyway. :)

If you enjoy your job, take great care! :innocent:

[Biohazard]

Very true Cookie, the usb secure surf was designed (by what I can gather) for shared PC's ie internet cafe's as such like, for people who spend the majority of there time on them.

It will be safe enough to use for hotmal accounts and bank accounts, the guys who designed the device certainly wouldn't have devised a 100% fool proof system, there still has to be a way to check what weirdos get upto, alot of dodgy sites for dodgy people.

I'm gonna get one and test it to see how good they really think it is..... interested to find out cookie storage and reg entries etc, will let ya know what I think.

[Colapop]

WHHAAATTT???? I'm not allowed to surf for pron at work????

[GR81]

WHHAAATTT???? I'm not allowed to surf for pron at work????na, its just a rumour!

[Cookie]

[...]I'm gonna get one and test it to see how good they really think it is..... interested to find out cookie storage and reg entries etc, will let ya know what I think.

That's the ticket. It certainly would have it's uses in domestic situations - at least I might not go to breakfast to find my 12 year old has printed out all my dodgy web surfing history from the night before! Unless he installed one of these the night before that is : http://www.keyghost.com/ Heh heh.

[Lias]

The best way to get around IT dept (sorry chaps) is this Secure surf (http://www.securesurfer.co.nz), have me order in already :blip:
That device still has to use the corporate proxy, and hence will still show up in logs. All its really doing is removing most (Possibly all but I doubt it) forensic evidence of your activities on that individual PC.. Not a silly idea for using internet cafes but hardly a way around a corporate proxy.

The proxy logs are still going to show SOMETHING going through. Even if it puts all its requests via an anonymizer service once the anonymizer service is blocked its fucked (and lets face it any half decent corporate network blocks them as fast as they pop up).

Here's how the process works.
Secure browser wants www.hotporn.com, and www.hotporn.com is blocked by the corporate firewall.
First it asks the corporate proxy for www.anonymizer.com/cgi-bin/wibble.pl?123sdgsf8q347824589dfsdf or something like that
www.anonymizer.com requests the page from www.hotporn.com, obfuscates or encrypts it, and sends it back to the proxy.
The proxy thinks the pages come from www.anonymizer.com and allows them through, and you see www.hotporn.com on your PC.

If the proxy starts blocking www.anonymizer.com too, then things start going to poo for you :-)
And if its anything like my network, all BLOCKED hits show up in the logs..
So I see you trying to goto www.hotporn.com and getting 403'd, then all these requests to www.anonymizer.com and faster than you can say "Formal notice of investigative meeting" I've sent a report to HR via my manager, you go down for serious misconduct and security is showing you the door.

I know of at least 3 staff who've resigned this year at my work due to "jump or be pushed" letters from HR, and I believe a few more may have gotten away with it purely because it was in their redundancy notice period and managers were being nice.

PS: ITs generally accepted that only the IT department is allowed porn on the work PC's because we write the rules for the lusers not ourselves :-)

[Biohazard]

Exactly what he said :shutup:

[sAsLEX]

and faster than you can say "Formal notice of investigative meeting" I've sent a report to HR via my manager, you go down for serious misconduct and security is showing you the door.

I know of at least 3 staff who've resigned this year at my work due to "jump or be pushed" letters from HR, and I believe a few more may have gotten away with it purely because it was in their redundancy notice period and managers were being nice.


And how is looking at porn/trademe/bank account so bad that they can sack you ?? Where if you swear at customers write swastikas on holocaust victims houses , steal from the company then they still cant fire your arse?!

I mean sure if they were stealing shit from the company but a little harmless surfing on what could be their own time!? ridiculous

[Sniper]

Lias, you are one of the greats :niceone:

To back up what Lias said. No matter what you look at, most good IT chaps know what to look for. If suddenly you are visiting www.a-bug.com most the time during the day and we have the slightest inkling or knowledge that you are not a bug person, then you will be checked out.

No matter what, if needs be, images and certain pages will be stored in your cache and bored people like me will browse through your personal files and see what you are not meant to be doing.... but thats only if there wasnt a privacy act :innocent:

[Lias]

And how is looking at porn/trademe/bank account so bad that they can sack you ?? Where if you swear at customers write swastikas on holocaust victims houses , steal from the company then they still cant fire your arse?!

I mean sure if they were stealing shit from the company but a little harmless surfing on what could be their own time!? ridiculous
Whats the bet that guy (painter wasnt he?) hadnt signed a contract agreeing to obey several reams of A4 worth of policy covering everything under the sun?

If you work here, you agree not to break the rules, and you agree that if you break the rules there will be consequences upto and including dismissal. Hell were not even particularly harsh about it, do the research there are several documented cases of employees being fired for sending personal emails on a corporate network that specifically stated that the network was for work use only. Others have been fired for posting comments on blogs about their place of employment, let alone been fired for surfing porn!

As for "on their own time" the computer, and the network are provided by the employer to you as a tool for work related use. You dont inherently have the right to do anything personal with them, even on your own time. Most companies that have a computer usage policy will allow for some personal use, others wont. We actually have a relatively liberal internet usage policy here. Basically aslong as your not surfing porn, streaming media, download craploads of anything (Ie excessive usage) or try to bypass our list of blocked sites we dont really care what you do. I have personally worked for firms where personal internet surfing was verbotten, and personal email use was tolerated only within strict guidelines. We also generally only push for formal HR action in the case of serious porn surfing, most other things we let slide with a permanent loss of internet access.

If a company gives you a signwritten company car to use during the performance of your duties, does that give you the right to drive around in it openly smoking pot and with 3 naked hookers in the back? I dont bloody think so and if you did you'd soon find the car taken off you if not being outright fired. Exactly the same thing applies to computer and internet usage.

[Ixion]

,,Others have been fired for posting comments on blogs about their place of employment, let alone been fired for surfing porn!

,,.

Very dodgy that one, only in USA I think and prolly only in the laughably misnamed "right to work" states (ie right to sack without any reason).

Could be caught up in a general 'duty of loyalty" thing in NZ, but it would have to be pretty bad, not just "XX is a shit company to work for" stuff. It's called freedom of speech.

Main reason IT don't like pron sites is (a) they're riddled with nasty shit and (b) if someone's downloading pron, it's bound to cause complaints from other , boobily-envious workers. and (c) when you enter a pron site it almost certainly captures your IP. Management don't really like the idea that Joe is perving on the kiddyporn site again, and the company's IP address (and thus name) is going into the police file. Could be embarassing.

There are ways around proxy servers, but really, it's not worth the trouble and risk of aggro from manglement.

[Ixion]

Interesting legal decision on this point, just out
http://www.stuff.co.nz/stuff/0,2106,3721288a11,00.html (http://www.stuff.co.nz/stuff/0,2106,3721288a11,00.html)

[Cookie]

Very interesting Ixion.

If what was reported is correct, with multiple users using the same username and password, the defense case is pretty damn easy to put together.

I can't see that the company has a leg to stand on during an appeal because surely they need to prove *who* was doing what. Obviously dodgy activity going on but they can't just punish people in the hope that they get some of those involved in the actual activity.

As usual, there is often more to the story blah blah but that's my 2 cents anyway.

[Wolf]

Main reason IT don't like pron sites is (a) they're riddled with nasty shit
Viruses, spyware, keyloggers - funnily enough, porn is popular enough to make it worth using as a lure to get people to visit.


(b) if someone's downloading pron, it's bound to cause complaints from other , boobily-envious workers.
And the Puritans. Or people with a serious idea about Corporate Image. At a previous job a tutor came into the IT Sanctum Sanctorum extremely pissed off that he had had a night class for some of Hamilton's top businessmen and he got them to turn their computers on and most of the machines in the lab had porn pics set as the wallpaper (by the students who regularly used the room) - he did not deem it a suitably professional image and felt the institute had lost face in front of some extremely important people.


(c) when you enter a pron site it almost certainly captures your IP. Management don't really like the idea that Joe is perving on the kiddyporn site again, and the company's IP address (and thus name) is going into the police file. Could be embarassing.
Our general policy - governing everything, not just Computer Use - says that an employee must not behave in a manner that calls the company into disrepute or would render the company liable for criminal proceedings. Getting your corporate IP range implicated in a kiddie porn ring would certainly qualify as a breach of that article.

[Wolf]

Very interesting Ixion.

If what was reported is correct, with multiple users using the same username and password, the defense case is pretty damn easy to put together.
Prosecution has a damn easy job in Mr Bisson's case - serious breach of network security, giving out your login to 23 people - in so doing, he accepts responsibility for the actions of all of them. You can't prove which employees surfed the bad sites, but Bisson admitted to giving them access - reinstate the apprentices and watch 'em like a hawk, sack Bisson for breaching security.

I always tell our employees, "do not give your login and password to anyone, if you do and the othe person deliberately or accidentally breaches the Acceptable Use Policy or the law, the logs will show your account to be at fault - you will be the one facing suspension, dismissal or possibly criminal charges."

If the breaches are serious enough - illegal - they would probably still be sacked even if the prosecution could not prove it was them who actually commited the crime. They provided the means for one to be committed, after all.

[sAsLEX]

Ok this is similar to the EULA's that we have all agreed to at some time. Now has anyone read any of them? They make them like a Clancy novel in length and throw in legal jargon to make them difficult to follow as well, hence no one reads them just ticks the box.

[Wellyman]

We found a way of getting on tardme at school, but I can't remeber right now but you do a search on something in google and follow one of the links and you can get into tardme, thats all i cann rember.
WM

[Cookie]

Prosecution has a damn easy job in Mr Bisson's case - serious breach of network security, giving out your login to 23 people - in so doing, he accepts responsibility for the actions of all of them. [...]

Fair comment Wolf - which is partly why I said there may be more to the story.

A lot of companys have "Acceptable Use" and network policy documents that the users never see, or have only had waved briefly under their noses when they first arrive.

Maybe every now and then something bad happens, and HR send out an email saying "Read This", thinking that has legally innoculated themselves for next time.

My understanding is that the best protection from the company's point of view is a copy of the company policy signed by the employee. Even click-through login screens with warnings (like the EULA" type thing sAsLEX referred to) is weak protection in NZ.

I'm not saying this is right or wrong, but the company really needs to have clear evidence that the worker has read, understood and signed the agreement before they can sack them outright for a single infringement.

Of course, there are more ways than one to get rid of someone but in a highly unionised workforce such as Air NZ, I would expect a battle on my hands.

[Wolf]

I'm not saying this is right or wrong, but the company really needs to have clear evidence that the worker has read, understood and signed the agreement before they can sack them outright for a single infringement.
Only to a certain degree, there are some things that could be deemed that a person should realise. How many people would give their company pass keys to all and sundry?

Giving out your login is giving your access to the entire system to someone else - sensitive data, company records, the ability to delete important information, etc - it is no different than giving someone your key to the secure areas.

People do not generally give their keys to others as it could be disastrous, why should they give out their access to the computer system?

As far as signed agreements not to make personal emails or other things that are not "intuitive", fair enough.

[Cookie]

[...]there are some things that could be deemed that a person should realise. How many people would give their company pass keys to all and sundry?[...]

I agree with you 100% Wolf. I am just repeating recent advice I was given by a legal firm with a background in this area.

I guess what you and I expect to be a "given" for intelligent human beings is not always the case in the courtroom. :confused:

Companies do well to protect themselves with signed agreements *before* the proverbial hits the fan is all I am saying.

[Lias]

Very valid points raised by Ixion and Cookie. I was sufficiently motivated by these to take the issue up with our CIO and ask him to investigate if our processes are robust enough to stand up legally, and if not to improve them to the point where they are. I'd absolutely hate to find some scumbag surfing something really objectionable and have it overturned in employment court on what really amounts to technicalities.

[Cookie]

[...]I'd absolutely hate to find some scumbag surfing something really objectionable and have it overturned in employment court on what really amounts to technicalities.

Yep. Here's a brief article from a Kiwi law firm on the subject of acceptable use policies that might be useful for IT departments to consider...

http://tinyurl.com/m3kee

-

[Lias]

Cheers for that! Copy sent to management.