Web filters mistakenly blocking Yahoo

Websense's products are meant to block malicious Web sites, but on Tuesday and Wednesday the Web filters also blocked Yahoo.com.

The blockade is the result of an erroneous update sent out to Websense customers late Tuesday afternoon, a representative for the San Diego, Calif.-based company said. "The details are still under investigation but some IP addresses associated with the Yahoo.com site were classified incorrectly," the representative said.

As a result, Web surfers at organizations that use Websense filtering software are unable to access the popular Web site. Websense on its Web site states that its products are used to filter Web traffic for about 24.5 million computers worldwide.

"Our helpdesk was flooded with calls this morning since people couldn't get to the search engine or e-mail for Yahoo due to the incorrect categorization," an IT pro at a large health care organization wrote in an e-mail to CNET News.com. "Looks like they are doing the best they can to fix it, but it's a pretty nasty 'oops.'"

The Websense products are used by organizations to prevent access to Web sites that contain malicious code, are part of a phishing scam, or are otherwise considered malicious. The system works with blacklists that Websense compiles and updates frequently.

Various versions of the Websense products are affected by the problem, including 4.4.1, 5.1, 5.5 and 6.1 through 6.3, the Websense representative said. An update to correct the issue on 6.1 systems was pushed out early Wednesday morning, and downloadable files to fix the other systems are slated to be available this afternoon, the representative said.

"Misclassifications of well-known sites are very rare," the Websense representative said. "We are reviewing processes, code, validation systems, etcetera and making adjustments to catch this kind of case in the future before publication of any files."

Such errors happen occasionally with security software, particularly antivirus products. For example, Symantec last month flagged Yahoo Mail as a virus, Microsoft's Windows Live OneCare in November warned that Google's Gmail contained a virus, and earlier last year, McAfee's security tools flagged Excel and other legitimate applications as threats.

Typically, these errors can be fixed by updating the signature files in security applications. These signatures are the rules used by the security program to identify malicious software.

[btljooz]

I wonder...

How does Yahoo! feel about this and what their response is. ?:|

[vraptorz]

Responsive updates

Websense did an excellent job of responding to user reports of the blocking of Yahoo. The actual cause was that a range of IP addresses used by Yahoo was included in a malicious category. Customers could immediately resolve the problem by Whitelisting Yahoo's domain name, but Websense had the problem resolved within hours of reports that it was an issue. Their customer support was prompt and informative.

[Razzl]

Spybot, too

Interesting. Last month when I downloaded updates to the free version of Spybot it inserted Yahoo addresses into the "prohibited" list on IE7, forcing me to find and remove them. Are these guys all getting their lists from the same place, or just not checking the results to make sure they don't block something they obviously shouldn't (like Paypal, yahoo, ebay, etc.)?