topic Re: Paloalto can't block hotspot shield. in General Topics

Paloalto can't block hotspot shield.

zm.tun — Tue, 28 Mar 2017 09:18:41 GMT

Dear all,

I am currently facing paloalto can't block and see hotspot shield app.

Our organization do not want to use ssl decryption to block hotspot shield.

Any other solutions to block hotsport shield without decryption ???

Thanks.

Re: Paloalto can't block hotspot shield.

santonic — Tue, 28 Mar 2017 09:53:17 GMT

I tried it just now and PA detected hotspot-shild app without SSL decrpytion. However i don't know what happens if you put it on block and app tries to connect to some less known IPs and/or URLs. I guess in that case SSL decryption is needed.

But that goes for any device; you need to decrypt SSL to be able to see what's inside. Without that you're limitd to known URL and IP blocking.

Re: Paloalto can't block hotspot shield.

reaper — Tue, 28 Mar 2017 10:33:45 GMT

hotspot-shield depends on ike, ipsec-esp-udp, ssl and web-browsing

maybe you're allowing ike or ipsec through in a different rule? (as these are generic protocols that can't be differentiated between layer7 applications)

Re: Paloalto can't block hotspot shield.

zm.tun — Thu, 06 Apr 2017 09:45:35 GMT

Thanks for your cooperation.

Currently, PA can block Hotspot Shield for computers.

But,PA did not know and can't still block Hotspot Shield for mobile phones such as android and IOS.

Do you have any idea to block Mobile Phone Hotspot Shield ???

Please let me know.

Re: Paloalto can't block hotspot shield.

MohamedSharief — Thu, 06 Apr 2017 10:56:30 GMT

It happened with me one time and I had to block unknown-tcp & unknown-udp to work. You may check this in the traffic monitor screen to see if this applications are really used on not.

Regards,

Sharief

Re: Paloalto can't block hotspot shield.

zm.tun — Fri, 07 Apr 2017 05:26:59 GMT

Thanks Sharief

Re: Paloalto can't block hotspot shield.

Ghafar — Mon, 10 Apr 2017 08:27:36 GMT

It seems that you are struggling with blocking Proxy applications like Hotspot Shield but the major point here is that you can only ensure that all Hotspot shield attempts are blocked by enabling the SSL Decryption.

As you say the SSL Decryption is not possible on your network then the possibility of the user to bypass the Firewall is high because these Proxy applications like Hotspot shield users IKE, IPSEC, SSH, SSL to create encrypted tunnels which will completely bypass the filtering...

You may block Unknown-UDP / TCP and it will block a considerable amount of users but again these apps are trying to bypass the limitation using these ports which will be very difficult to block with a security policy....

Ports: 22, 53, 443, 80, 8080 and many mores or it will open ports....

Monitoring the logs will shows the App is blocked but in the other hand many attempts has already bypassed the firewall...

Re: Paloalto can't block hotspot shield.

PBotchway — Mon, 11 Dec 2023 11:33:17 GMT

hello Zm.Tun,

I am facing the same issue, Please share with me your methods to block hotspot shields even on PCs and laptops?

Re: Paloalto can't block hotspot shield.

OtakarKlier — Mon, 11 Dec 2023 20:11:30 GMT

Hello,

Looks like there is an application for this now.

Regards,