Paloalto can't block hotspot shield.

[zm.tun]

Dear all,

I am currently facing paloalto can't block and see hotspot shield app.

Our organization do not want to use ssl decryption to block hotspot shield.

Any other solutions to block hotsport shield without decryption ???

Thanks.

[santonic]

I tried it just now and PA detected hotspot-shild app without SSL decrpytion. However i don't know what happens if you put it on block and app tries to connect to some less known IPs and/or URLs. I guess in that case SSL decryption is needed.

But that goes for any device; you need to decrypt SSL to be able to see what's inside. Without that you're limitd to known URL and IP blocking.

[reaper]

hotspot-shield depends on ike, ipsec-esp-udp, ssl and web-browsing

maybe you're allowing ike or ipsec through in a different rule? (as these are generic protocols that can't be differentiated between layer7 applications)

[zm.tun]

Thanks for your cooperation.

Currently, PA can block Hotspot Shield for computers.

But,PA did not know and can't still block Hotspot Shield for mobile phones such as android and IOS.

Do you have any idea to block Mobile Phone Hotspot Shield ???

Please let me know.

[MohamedSharief]

It happened with me one time and I had to block unknown-tcp & unknown-udp to work. You may check this in the traffic monitor screen to see if this applications are really used on not.

Regards,

Sharief

[zm.tun]

Thanks Sharief

[Ghafar]

It seems that you are struggling with blocking Proxy applications like Hotspot Shield but the major point here is that you can only ensure that all Hotspot shield attempts are blocked by enabling the SSL Decryption.

As you say the SSL Decryption is not possible on your network then the possibility of the user to bypass the Firewall is high because these Proxy applications like Hotspot shield users IKE, IPSEC, SSH, SSL to create encrypted tunnels which will completely bypass the filtering...

You may block Unknown-UDP / TCP and it will block a considerable amount of users but again these apps are trying to bypass the limitation using these ports which will be very difficult to block with a security policy....

Ports: 22, 53, 443, 80, 8080 and many mores or it will open ports....

Monitoring the logs will shows the App is blocked but in the other hand many attempts has already bypassed the firewall...

[PBotchway]

hello Zm.Tun,

I am facing the same issue, Please share with me your methods to block hotspot shields even on PCs and laptops?

[OtakarKlier]

Hello,

Looks like there is an application for this now.

Regards,