[#20240701-0110] - anti-virus and threat detection within websocket connections

[TRisec]

Hi,

I just came across an interesting question regarding websocket connections running through an NGFW. How does virus inspection and threat detection work here? From what I know websocket connections aren't compatible with normal HTTP connections (ignoring wss for the moment which might be a different problem). So is an NGFW still able to scan those connections? I haven't found any documentation on this explaining the matter.

Best regards

Oliver

[RomainSalmon]

Hello,

This is a good question. I have decrypted websocket trafic on the firewall and the vulnerability protection profile have matched some signatures for this flow. I can't tell you more about this so you may open a tac in order to get this information.

Have a good day

[TRisec]

Hello Romain,

thanks for your reply.

We did some tests on this and could upload the EICAR test virus, when using a websocket connection. The same file was blocked instantly, when using a standard http session. The same happened when sending crafted links like for log4j.

I've already opened a TAC case and we will do an analysis with PA shortly.

Best regards,

Oliver