Hacker News Reader

Comment by MichaelApproved | Hacker News Reader

I doubt that could that be it. Blocking by user agent would be a terrible idea. Way too broad a net and could easily be abuse to shut down major browsers. Also easily bypassed by changing the agent name.

Does anyone have first hand experience with a WAF that did that?

View on HN

It's quite common for extremely dumb bots to fake impossible UA's for various brute-force attack. Usually, something in the line of Microsoft Edge for PPC Linux or something equally silly. In such cases it's easy to get a WAF to block the impossible combinations. The bots are usually simple enough that such simple measures block a large amount of the botnet traffic.

In our case, we block the impossible combos and rate-limit the ones commonly used by botnets.

Blocking based on whether the UA has "Linux" in it is just dumb, though.

Much hyped "disruptive deep machine-learning smart AI" used for, i.e. fraud detection work the same way: by finding features commonly used by fraudsters and discriminating everyone having the same features (i.e. user agent, time of purchase, items purchased, even name on card).

Old-school non-computerized discrimination (i.e. racism) work exactly the same way.

> Blocking by user agent would be a terrible idea.

You know what else is a terrible idea? Blocking IP ports in firewalls, or MAC based filtering, yet both of these are ubiquitous practices. Don't think something is not happening because you think is a bad idea. Other people, usually the ones in charge will often disagree.

Yes, it’s possible. Not out of the box usually, but someone probably added a custom rule.

Especially if you’re facing an attack from a common UserAgent with all the other variables changing. And the admin likely thought “Linux users don’t use this service.”

I've seen Cloudflare block based on user-agent alone.

UA is a blocking mechanism in WAFs. Also, (Akamai or <web proxy> fix your shit), re-ordered HTTP headers do the same thing.

If you're behind a MITM web proxy at work, try going to Lowes.com - there's a chance you'll get blocked by their Akamai filter for putting headers back in the "wrong" (there is no wrong) way.

Reply on news.ycombinator.com