topic Re: How to block dodge chrome? in General Topics

How to block dodge chrome?

wooki — Thu, 18 Sep 2014 13:24:12 GMT

Hi.. all

Do you know "dodge chrome"?

This is bypass the url filtering by the modified google chrome.

(http method : get \r\n )

I do not find the related signature in palo alto applipdia.(app-id , ips , virus)

How to block dodge chrome?

Re: How to block dodge chrome?

HULK — Thu, 18 Sep 2014 14:27:47 GMT

Hello Wooki,

Could you please go through this doc:

Enabling Strip X-Forward-For Feature Blocks Communications to Certain Websites

Did you try the custom signature to block this:

Creating Custom Threat Signatures

Custom Application Signatures

Thanks

Re: How to block dodge chrome?

pulukas — Thu, 18 Sep 2014 15:37:28 GMT

You can probably do a packet capture and modify this procedure that blocks Chrome to be unique for Dodge Chrome.

How to Block Google Chrome

Re: How to block dodge chrome?

kfindlen — Thu, 18 Sep 2014 23:28:44 GMT

Finally found a build of DodgeChrome with some google-fu and did some testing. Traffic generated by this client is identified as unknown-tcp by the firewall, not web-browsing. If you block unknown-tcp the client will be unable to transfer data.

Custom signatures will not be possible for this because the string you are looking for is less than 7 bytes, and with the session identified as unknown-tcp you can not utilize HTTP contexts for pattern matching.

Re: How to block dodge chrome?

wooki — Tue, 23 Sep 2014 07:27:34 GMT

Thanks a lot !!!!