4

Objectives

  1. Hopefully someone can provide an answer or clue of some sort
  2. Notify the StackOverflow community of a possible issue

Background

I was doing some research on a Visual Basic in InfoPath issue and after doing a search on StackOverflow, I was opening several of the questions to read through but this one specifically triggered my company's WebSense trigger while the other questions were ok. I'm not asking anyone to troubleshoot our WebSense, I've already notified our admin and he is scratching his head as well. Other posts have had the same issue but it has been a very rare occurrence. I already know that WebSense has had issues with Meta and Chat but this was a typical programming post with seemingly innocent subject matter.

Question

What is the most likely content on the target post that could be triggering WebSense to block the page?

Post in question

Question about CreateObject() in VB6 / VBA

General Discussion

Now, I've already solved my initial problem and don't really need to get back to the question but I do want to know what is causing the block. In addition, this might be happening to other users so it is worth a look by the SO crew. Is it code in the question or answer? Is it links in the sidebar? I don't think it's advertising links (again, not sure here) because I always browse as a logged in user.

Improve this question
8
  • 6
    Probably the reference to registry keys. Your security might interpret that as something malicious that's usually part of most viruses.
    – Linuxios
    Jun 19, 2013 at 22:24
  • Oh great, now OP won't be able to respond to this post.
    – 000
    Jun 19, 2013 at 22:41
  • Nope, still here. Meta is not blocked for me while Chat is, sadly.
    – Kelly S. French
    Jun 19, 2013 at 22:46
  • Whoa. Big meta post is big.
    – Manishearth
    Jun 20, 2013 at 14:12
  • It's just HTML. Inside <code> and </code> tags. It's 100% harmless, WebSense should really change their logic.
    – Shadow Wizard Love Zelda
    Jun 20, 2013 at 14:14
  • Adding the keys to the post triggered WebSense, so I moved them into an Answer and tried to "encode" them to keep from setting WebSense off again.
    – Kelly S. French
    Jun 20, 2013 at 14:25
  • I'm getting an error when I try to edit the OP to remove the registry keys. If someone can help me by removing the 'followup' section, I would appreciate it.
    – Kelly S. French
    Jun 20, 2013 at 14:27
  • I rolled back to remove the followup but lost the tag edit. Still can't edit.
    – Kelly S. French
    Jun 20, 2013 at 15:00

1 Answer 1

Reset to default
2

Theory

Windows Registry Keys are triggering WebSense

Reasoning

The post in question is mentioning two specific Windows registry entries (breaking up the text to keep this post from also being blocked by WebSense)

HKEY_CLASSES_ROOT (slash) Scripting.FileSystemObject
HKEY_CLASSES_ROOT (slash) CLSID (slash) (left curly brace)0D43FE01(dash)F093(dash)11CF(dash)8940(dash)00A0C9054228(right curly brace)

Where the second key is the CLSID of the Scripting.FileSystemObject COM component. My admin is going to open a support request with WebSense and the plan is to update this question with their response. It makes sense that the registry keys for scripting might be considered suspicious if you are looking for malicious code.

Experiment

After submitting this question, I was able to browse it without triggering WebSense. I edited the post to include the suspicious registry keys, and after saving it attempts to pull up the post were blocked by WebSense

Follow Up

Is there something SO can do to indicate that the content is not part of a program, or otherwise signal to WebSense that the text is innocuous? I know that is a tall order but Jeff Atwood's many posts and podcasts have mentioned just how much effort has been put into making sure that malicious material doesn't make its way into the SO database, maybe someone can contact WebSense and get them to reformulate their algorithm to be less suspicious of posts on SO.

Improve this answer
3
  • 2
    We try to keep them in code blocks (but some users post them outside of them). Aside from that, there's nothing SO can do. If WebSense is triggering because of something like that, it's their fault and always will be their fault. We can't be held responsible for their false positives.
    – animuson StaffMod
    Jun 22, 2013 at 16:03
  • If there was some sort of "not malicious" tag, I expect it would be abused heavily by malicious sites... FWIW, WebSense has (or had at one time) a reasonably straightforward process for submitting false-positives - if you run across something like this, just use it.
    – Shog9
    Jun 26, 2013 at 23:47
  • @Shog9 I expected as much but will still follow up with WebSense in case we can make them see the light. Also for what it's worth, using whitespace did not fool WebSense (ASCII 32 or 255) but the current 'encoding' scheme did, I can visit this post from work without being blocked.
    – Kelly S. French
    Jul 2, 2013 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .