3 ms·
Likely the WAF (web application firewall) responding to malicious use that happened to use that user agent.
by rblatz 8y ago
Likely the WAF (web application firewall) responding to malicious use that happened to use that user agent.
- MichaelApproved 8y agoI doubt that could that be it. Blocking by user agent would be a terrible idea. Way too broad a net and could easily be abuse to shut down major browsers. Also easily bypassed by changing the agent name. Does anyone have first hand experience with a WAF that did that?
- ahje 8y agoIt's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic. In our case, we block the impossible combos and rate-limit the ones commonly used by botnets. Blocking based on whether the UA has "Linux" in it is just dumb, though.
- crypt1d 8y agoI've seen Cloudflare block based on user-agent alone.
- unethical_ban 8y agoUA is a blocking mechanism in WAFs. Also, (Akamai or <web proxy> fix your shit), re-ordered HTTP headers do the same thing. If you're behind a MITM web proxy at work, try going to Lowes.com - there's a chance you'll get blocked by their Akamai filter for putting headers back in the "wrong" (there is no wrong) way.
- ungzd 8y agoMuch hyped "disruptive deep machine-learning smart AI" used for, i.e. fraud detection work the same way: by finding features commonly used by fraudsters and discriminating everyone having the same features (i.e. user agent, time of purchase, items purchased, even name on card). Old-school non-computerized discrimination (i.e. racism) work exactly the same way.
- eeeeeeeeeeeee 8y agoYes, it’s possible. Not out of the box usually, but someone probably added a custom rule. Especially if you’re facing an attack from a common UserAgent with all the other variables changing. And the admin likely thought “Linux users don’t use this service.”
- 4ad 8y ago> Blocking by user agent would be a terrible idea. You know what else is a terrible idea? Blocking IP ports in firewalls, or MAC based filtering, yet both of these are ubiquitous practices. Don't think something is not happening because you think is a bad idea. Other people, usually the ones in charge will often disagree.
- PhasmaFelis 8y agoIf so, someone is very stupid. Spoofing the user agent is extremely easy, so much so that many browsers have it as a built-in option for testing purposes. Blocking a user agent to keep hackers out is roughly as effective as taping a poster that says "NO CRIMINALS PLZ" over your front door.
- ahje 8y agoBlocking user agents does not provide security, but it does increase the cost of attack which is perfectly acceptable as a part of a larger defence strategy. It's like moving SSH to another port -- it won't stop anyone who knows what they're doing, but the majority of the bots that blindly connect to port 22 on every single host that has it open will be stopped by it.
- londons_explore 8y agoIf I were a criminal and saw a "NO CRIMINALS PLZ" sign on the door of a house, I think I'd be far less likley to break in... That houseowner has probably set boobytraps etc.