topic Re: Using Objects Custom Vulnerability in General Topics

Using Objects Custom Vulnerability

Alpalo — Wed, 16 Mar 2022 10:14:33 GMT

Hello,

We have an object so that from the wifi networks for mobile devices (mobile or tablets) if you connect by a pc to it can not go out.
We are doing this for the Vulnerability with the Threat id XXXX with the condition Pattern -mach http-req-headers and there are different headers.
The problem is that when the traffic is HTTPS it does not show the header and allows the navigation for laptops.
Can you tell us how we can block this traffic only for pc?

Any idea?

Re: Using Objects Custom Vulnerability

BPry — Wed, 16 Mar 2022 14:01:05 GMT

@Alpalo,

Unless you are decrypting traffic you would need to add signatures with one of the SSL contexts specified.

Re: Using Objects Custom Vulnerability

Alpalo — Thu, 17 Mar 2022 16:26:59 GMT

to which of the specified SSL contexts do you refer?

Re: Using Objects Custom Vulnerability

BPry — Thu, 17 Mar 2022 20:07:30 GMT

@Alpalo

You can't gather the User Agent string for encrypted traffic as far as I'm aware. You can look through the string contexts HERE along with what data is available, but fairly certain you won't get this unless you decrypt traffic.