How To Access Blocked Sites Using Google Web Cache, And How To Prevent It With Sophos UTM
I thought I’d show you a simple way people can access blocked sites using Google’s Web Cache, and how you can utilise Sophos UTM to prevent it.
Scott GlewI thought I’d show you a simple way people can potentially access blocked sites using Google’s Web Cache, and how you can use Sophos UTM to prevent it.
Google crawls, indexes and caches all websites on the Internet in its mission to organize the world's information. What you may not know is that you can access Google's cached copy of any website using a simple cache: directive in the Google search box. This includes websites that your company, school or organization is actively blocking with URL filtering.
In the video above, I demonstrate how to use Google's Web Cache to access YouTube.com after creating a web filter policy in Sophos UTM to block it.
The technique is quite simple. Go to google.com and enter cache: followed by the site you want to access. For example:
Link: cache:https://www.youtube.com
Because content is retrieved the webcache.googleusercontent.com domain, it does not match any URL filters you have defined, such as YouTube.com in my example.
After investigating the allowed traffic using Fastvue Sophos Reporter, I discovered that Sophos UTM was categorizing the webcache.googleusercontent.com domain as Anonymizing Utilities, and blocking that category was the best way to prevent the bypass technique.
Watch the video for more information, such as the effect of using Application Control to block YouTube through the Google Web Cache.
I hope this helps! If you found this useful, let me know in the comments!
4 Comments
Archived from our previous comment system.
- sebastian
hello, if i configure the categories like you did and check it with the policy test tool, the url webcache.googleusercontent.com shows as category content server, and not anonymizer. was this changed? or can i block content server as well?
- Scott Glew
Hey Sebastien,
I know that Sophos UTM will categorize a site into several categories when required. Therefore webcache.googleusercontent.com could be classified many different ways depending on how it is used.
From what I could see, if you use webcache.googleusercontent.com to retrieve arbitrary web content, it will get classified as Anonymizing Utilities, amongst other things.
The best way to find out would be to view the Web Filtering live log and access a website this way. View the categories that get logged for that content (or use Fastvue Sophos Reporter to find out like in the article ;)).
I hope this helps! Let me know how you go.
- Scott Glew
Oh, and I wouldn't recommend blocking the Content Server category as most of the web would then stop working for your organization. Most sites use Content Servers (CDNs) such as Akamai or Cloudfront (Amazon) to serve content from.
- Chopper
Hi my company used Sophos Endpoint Protection. I tried to access cache:http://www.facebook.com, the site itself appeared but when I tried to log in it shows in my browser "Your connection is not private". As far as I know Facebook and other social media sites are in the blocked list. Any way to to access the blocked sites?