topic Re: SSL decrpytion and TeamViewer in General Topics

SSL decrpytion and TeamViewer

santonic — Wed, 01 Jun 2016 07:28:07 GMT

I was wondering if TeamViewer uses certificate pinning so I tried to decrypt it. I've set a simple decrypt rule to decrypt everything from one IP going to internet. But the rule doesn't seem to work for TeamViewer. All SSL sessions are decrypted but teamviewer-base isn't. I've also tried sharing file over it and I didn't see it in data log, also application didn't change to teamviewer-sharing. So I'm pretty sure TeamViewer didn't get decrypted while other SSL sessions did.

Any idea what am i missing? If teamviewer doesn't allow to be decryted then i would expect to not be able to connect and not just ignore decryption rule and work.

Re: SSL decrpytion and TeamViewer

Raido_Rattameister — Wed, 01 Jun 2016 09:06:33 GMT

There is a list of applications that Palo Alto will not decrypt as it knows it will brake the app.

List is here:

https://live.paloaltonetworks.com/t5/Configuration-Articles/List-of-Applications-Excluded-from-SSL-Decryption/ta-p/62201

Try to play around with Decryption profile. There you can block sessions if decryption is not possible.

Re: SSL decrpytion and TeamViewer

santonic — Wed, 01 Jun 2016 09:13:56 GMT

Ok, ty for the list. But TeamViewer is not on it.

I guess that means TeamViewer either uses unsupported versions or cipher suites.