topic Re: Pokemon GO in Custom Signatures

Pokemon GO

aelmore — Tue, 12 Jul 2016 04:04:26 GMT

With the rise in popularity of the new Pokemon GO app, has anyone had the opportunity to build a signature or possibly even gather a pcap of the traffic that could be shared (the site is not allowing signups right now so I am unable to produce my own test traffic to collect).

I have received complaints from as high as our CIO, that too many people are walking around playing this game and we need to report on it and block is ASAP.

Any help is appreciated,

-adam

Re: Pokemon GO

BenjAudy.MTL — Wed, 13 Jul 2016 03:50:10 GMT

Hi,

I haven't seen the game's traffic since it hasn't been released yet in Canada, but the developer's previous game called Ingress relies heavily on Google API. You might have a hard time identifying the application without decrypting the traffic.

Regards,

Benjamin

Re: Pokemon GO

tboire — Wed, 13 Jul 2016 12:39:47 GMT

Hello,

From my research you can block the domain pgorelease.nianticlabs.com and the clients will not be able to reach out to the server to play the game. This does not however stop the employee from using their mobile data plan to continue playing the game.

Regards,

Tyler

Re: Pokemon GO

aelmore — Wed, 13 Jul 2016 13:31:02 GMT

Thanks for all the feedback. I can confirm that I also see the app attempting to use the following URLs:

pgorelease.nianticlabs.com
- Using a *.nianticlabs.com certificate
appload.ingest.crittercism.com
- Using a *.ingest.critterciscm.com certificate

The latter URL appears to be a third party app analytics company. I've yet to receive an executive order to authorize blocking, but I believe tboire is likely correct that blocking the Niantic URL will prevent connections. Should I get approval to block, that is my next course of action.

Thanks everyone.

Re: Pokemon GO

acc6d0b3610eec313831f7900fdbd235 — Mon, 19 Jun 2017 04:44:58 GMT

Hi @aelmore @tboire @BenjAudy.MTL

I know I am late in this thread, but I wanted to share this two options with you all.

Option 1: URL filtering

Simply blacklist the following url: pgorelease.nianticlabs.com (this is used to make API calls by the APP)

Option 2: Create a custom application which looks for the SNI string

set application pokemon-go default port tcp/443

set application pokemon-go signature PG-SSL and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match pattern pgorelease.nianticlabs.com

set application pokemon-go signature PG-SSL and-condition "And Condition 1" or-condition "Or Condition 1" operator pattern-match context ssl-req-client-hello

set application pokemon-go signature PG-SSL scope protocol-data-unit

set application pokemon-go signature PG-SSL order-free no

set application pokemon-go signature PG-SSL comment “Pattern match against the SNI for Pokemon Go"

set application pokemon-go category media

set application pokemon-go subcategory gaming

set application pokemon-go technology client-server

set application pokemon-go description "Pokemon Go is a social game released in 2016 by Niantic Labs."

set application pokemon-go risk 1

set application pokemon-go parent-app ssl