How to block dodge chrome?

[wooki]

Hi.. all

Do you know "dodge chrome"?

This is bypass the url filtering by the modified google chrome.

(http method : get \r\n )

I do not find the related signature in palo alto applipdia.(app-id , ips , virus)

How to block dodge chrome?

[HULK]

Hello Wooki,

Could you please go through this doc:

?

Enabling Strip X-Forward-For Feature Blocks Communications to Certain Websites

Did you try the custom signature to block this:

Creating Custom Threat Signatures

Custom Application Signatures

Thanks

[pulukas]

You can probably do a packet capture and modify this procedure that blocks Chrome to be unique for Dodge Chrome.

How to Block Google Chrome

[kfindlen · Accepted solution]

Finally found a build of DodgeChrome with some google-fu and did some testing.  Traffic generated by this client is identified as unknown-tcp by the firewall, not web-browsing.  If you block unknown-tcp the client will be unable to transfer data. 

Custom signatures will not be possible for this because the string you are looking for is less than 7 bytes, and with the session identified as unknown-tcp you can not utilize HTTP contexts for pattern matching.

[wooki]

Thanks a lot !!!!