topic Re: [#20240701-0110] - anti-virus and threat detection within websocket connections in Next-Generation Firewall Discussions

[#20240701-0110] - anti-virus and threat detection within websocket connections

TRisec — Thu, 18 Jul 2024 09:10:46 GMT

Hi,

I just came across an interesting question regarding websocket connections running through an NGFW. How does virus inspection and threat detection work here? From what I know websocket connections aren't compatible with normal HTTP connections (ignoring wss for the moment which might be a different problem). So is an NGFW still able to scan those connections? I haven't found any documentation on this explaining the matter.

Best regards

Oliver

Re: [#20240701-0110] - anti-virus and threat detection within websocket connections

RomainSalmon — Tue, 23 Jul 2024 09:23:20 GMT

Hello,

This is a good question. I have decrypted websocket trafic on the firewall and the vulnerability protection profile have matched some signatures for this flow. I can't tell you more about this so you may open a tac in order to get this information.

Have a good day

Re: [#20240701-0110] - anti-virus and threat detection within websocket connections

TRisec — Tue, 23 Jul 2024 09:39:16 GMT

Hello Romain,

thanks for your reply.

We did some tests on this and could upload the EICAR test virus, when using a websocket connection. The same file was blocked instantly, when using a standard http session. The same happened when sending crafted links like for log4j.

I've already opened a TAC case and we will do an analysis with PA shortly.

Best regards,

Oliver