topic Re: cannot block hotspot shield in General Topics

cannot block hotspot shield

shabeerc — Sun, 03 Feb 2013 11:35:54 GMT

it seems it has became vey diffcult to block hotspot shield , even though the application is being idenfied by palo alto , still hot spot finds it way by port 80 . is there any way to block hot spot shield.Also From IPAD/IPHONE it is easily connecting

Thanks

Shabeer

Re: cannot block hotspot shield

sdurga — Sun, 03 Feb 2013 19:07:33 GMT

do you mean, paloalto is not identifying the traffic, if the hotspot shield is using port 80 ? . and also from ipad/iphone it is connecting ? how is the traffic identified in this case ?

Can you provide this information from logs ?

Thanks,

Sandeep T

Re: cannot block hotspot shield

MarshallMims — Mon, 01 Apr 2013 22:26:37 GMT

I'm getting a similar issue, have a user using Hotspot Shield , and even though i've told PA to block the app, its still working. comes across port 80 as "unknown-tcp" and port 990 as "insufficient-data"

any help would be appreciated.

Re: cannot block hotspot shield

mikand — Tue, 02 Apr 2013 03:05:39 GMT

First of all, did you enable ssl-termination (unless Im wrong hotspot shield tries to use ssl to bypass firewalls)?

Second, I doubt that the port 990 traffic identified as "insufficient-data" would be enough to make the application run in long term (perhaps only as a way to find other nodes) - from the admin guide:

* Incomplete - A handshake took place, but no data packets were sent prior to the timeout.

* Insufficient-Data - A handshake took place followed by one or more data packets; however, not enough data packets were exchanged to identify the application.

If you are positive that the PA didnt successfully identify hotspot shield even if you were using ssl-termination (as a debug use both "log on session start" and "log on session end" on all rules) you can contact the appid team and submit some pcaps so they can improve the hotspot shield detection: Tools &lsaquo; Palo Alto Networks BlogPalo Alto Networks Blog

Re: cannot block hotspot shield

Retired Member — Tue, 02 Apr 2013 18:27:43 GMT

A case has been opened for that.Support saw the same issue.They are working on it.They will solve soon.

Re: cannot block hotspot shield

MarshallMims — Tue, 02 Apr 2013 18:38:06 GMT

thanks. i ended up blocking "unknown-tcp" for now until we find a better resolution. after i did that i started seeing the hotspot-shield app-id start hunting ports trying to get out, but wasnt able too.. now i see him trying to get to ultrasurf and cyberghost vpn, but url filter is catching him. Its fun to watch them squirm

Re: cannot block hotspot shield

afiq — Fri, 05 Apr 2013 03:11:27 GMT

from url filtering able to block ultrasurf? you mean the poxies category?:smileymischief:

Re: cannot block hotspot shield

Retired Member — Fri, 05 Apr 2013 07:07:30 GMT

Support told me that(on my case) they found the issue and working on it to resolve it.