Suspicious TLS Evasion Found

[JohnCSteamer]

PA-3020

Recently I've had several users get a "Virus/Spyware Download Blocked" page on random sites.  Normally they get it on google searches.  If they refresh, sometimes the error stays, and sometimes it just takes them to the page.  

It even happened to me the first time I tried coming to this site, but a refresh took me here.  Here's an example of the error for another site I tried to go to.

When I log into the PA, and look under Monitor->Threat, I have the following errors:

I'm fairly new to PA systems, and it seemed odd to me, that my IP address was listed as the Attacker, and google was listed as the Victim.  Also, for my traffic at least, they are listed as Suspicious TLS Evasion Found, on what looks to be google ads.  I listed the URL's at the top right of the above image.  Any ideas on what could be causing this.  

In addition, we've also seen things like broken images from sites, that show as the same error in the PA "Suspicious TLS Evasion Found", or Suspicious HTTP Evasion Found.

[Brandon_Wertz · Accepted solution]

Looks like this threat has been out for a while and only modified back in April.  Also the default action is set to allow, so by chance do you know have you modified some default actions for "Informational" threats?

 It also might be worth getting a PCAP of your traffic and opening a ticket with support and let them analyze the traffic to see if something is getting misidentified. 

[John.Petrucci]

This signature seems a little too trigger happy.  I see it get detected frequently.  What constitutes a "suspicious TLS evasion"?

[jvalentine]

This signature works best when you're using the dns-proxy feature on the firewall.  I'd recommend either configuring the dns-proxy on the firewall (and pointing your clients to use the dns-proxy as their DNS server) or disable that particular signature.  

[John.Petrucci]

Do you know why that is?  What is it about DNS proxy that reduces matches against Suspicious TLS Evasion?

[phrdlicka]

Main article with details on TLS and HTTP evasion is available at:

https://live.paloaltonetworks.com/t5/Customer-Advisories/Information-regarding-TLS-HTTP-header-evasi...

The inclusion of DNS proxy ensures that the client will receive exactly same server IP address that the firewall has resolved.

There are three possible scenarios:

1) Client does not send a DNS requests and connects directly to the IP with specific SNI header on Client Hello request. Firewall performs a lookup on the domain in SNI header and if the IP address returned by DNS server matches destination IP of clients request, the traffic will be passed, else it will trigger evasion signature.

2) Client sends DNS request directly to external DNS server and subsequently connects to the IP address that was returned by the server with corresponding SNI header. Firewall performs a lookup on the domain in SNI header and if the IP address matches, the traffic will be passed, else it will trigger evasion signature. Note that firewall's and client's DNS requests are independent, and thus each can have a different IP address returned. This is common for large, cloud-based websites (Google, Facebook etc.) that use this for load-balancing purposes.

3) Client send DNS request to DNS proxy on the firewall. Firewall performs DNS lookup and sends client the IP address returned by DNS server. In this case client and firewall have received same IP address for the domain and therefore the subsequent connection from client will match the IP with the SNI header (the result from DNS query is cached on the firewall and no further lookup is necessary). Traffic is therefore allowed.

For associated Suspicious HTTP Evasion Found feature the mechanism is the same, except the lookup is done for Host header in HTTP request instead of SNI.