3 ms·

I doubt that could that be it. Blocking by user agent would be a terrible idea. Way too broad a net and could easily be abuse to shut down major browsers. Also

I doubt that could that be it. Blocking by user agent would be a terrible idea. Way too broad a net and could easily be abuse to shut down major browsers. Also easily bypassed by changing the agent name. Does anyone have first hand experience with a WAF that did that?

ahje 8y ago
It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic. In our case, we block the impossible combos and rate-limit the ones commonly used by botnets. Blocking based on whether the UA has "Linux" in it is just dumb, though.
crypt1d 8y ago
I've seen Cloudflare block based on user-agent alone.
unethical_ban 8y ago
UA is a blocking mechanism in WAFs. Also, (Akamai or <web proxy> fix your shit), re-ordered HTTP headers do the same thing. If you're behind a MITM web proxy at work, try going to Lowes.com - there's a chance you'll get blocked by their Akamai filter for putting headers back in the "wrong" (there is no wrong) way.
ungzd 8y ago
Much hyped "disruptive deep machine-learning smart AI" used for, i.e. fraud detection work the same way: by finding features commonly used by fraudsters and discriminating everyone having the same features (i.e. user agent, time of purchase, items purchased, even name on card). Old-school non-computerized discrimination (i.e. racism) work exactly the same way.
eeeeeeeeeeeee 8y ago
Yes, it’s possible. Not out of the box usually, but someone probably added a custom rule. Especially if you’re facing an attack from a common UserAgent with all the other variables changing. And the admin likely thought “Linux users don’t use this service.”
4ad 8y ago
> Blocking by user agent would be a terrible idea. You know what else is a terrible idea? Blocking IP ports in firewalls, or MAC based filtering, yet both of these are ubiquitous practices. Don't think something is not happening because you think is a bad idea. Other people, usually the ones in charge will often disagree.

ahje 8y ago

It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic. In our case, we block the impossible combos and rate-limit the ones commonly used by botnets. Blocking based on whether the UA has "Linux" in it is just dumb, though.

crypt1d 8y ago

I've seen Cloudflare block based on user-agent alone.

unethical_ban 8y ago

UA is a blocking mechanism in WAFs. Also, (Akamai or <web proxy> fix your shit), re-ordered HTTP headers do the same thing. If you're behind a MITM web proxy at work, try going to Lowes.com - there's a chance you'll get blocked by their Akamai filter for putting headers back in the "wrong" (there is no wrong) way.

ungzd 8y ago

Much hyped "disruptive deep machine-learning smart AI" used for, i.e. fraud detection work the same way: by finding features commonly used by fraudsters and discriminating everyone having the same features (i.e. user agent, time of purchase, items purchased, even name on card). Old-school non-computerized discrimination (i.e. racism) work exactly the same way.

eeeeeeeeeeeee 8y ago

Yes, it’s possible. Not out of the box usually, but someone probably added a custom rule. Especially if you’re facing an attack from a common UserAgent with all the other variables changing. And the admin likely thought “Linux users don’t use this service.”

4ad 8y ago

> Blocking by user agent would be a terrible idea. You know what else is a terrible idea? Blocking IP ports in firewalls, or MAC based filtering, yet both of these are ubiquitous practices. Don't think something is not happening because you think is a bad idea. Other people, usually the ones in charge will often disagree.