blocking wpad connections..?

AlexandervW

@all,

is there a way to block wpad connections or does it have to be allowed? As far as i understand, wpad is like a proxy, so a firewall cannot look into the traffic which is handled with it. Or does even the Zyxel FW handle wpad and acts therefore as a proxy. I am a bit lost here, searching the www does bring any light in this. Anyone share his knowlegde. That would be very welcome...

Alexander

jasailafan

Found one IPS signature on the device. Not sure if it can block wpad in your network. You can have it a try. There are also some suggestions for prevention of wpad attack. 

https://security.stackexchange.com/questions/251734/how-to-properly-deal-with-wpad-attacks

https://nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/

jasailafan

Found one IPS signature on the device. Not sure if it can block wpad in your network. You can have it a try. There are also some suggestions for prevention of wpad attack. 

https://security.stackexchange.com/questions/251734/how-to-properly-deal-with-wpad-attacks

https://nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/

AlexandervW

Many thanks jasailafan, that will bring me one step furher...