whatsapp app

  • 29 June 2023
  • 7 replies
  • 214 views

Userlevel 1
Badge +5

I am reviewing and I notice that when I use the WhatsApp app and attach an image it is not sent, I do not have associated blocking policies and additionally create a real-time policy where permission is granted to upload and download files.

If I enter through a browser, if it allows me to attach all the images, I wanted to check whether netskope restricts the sending of attachments through the App?


7 replies

Userlevel 3
Badge +11

@xavy2310 what OS you are using for tests?

Userlevel 1
Badge +5

Windows 10 @borisgekhtman 

Userlevel 3
Badge +11

@xavy2310 I was able to reproduce it. Apparently fat client for Windows got certificate pinned recently. You should add certificate pinning exception for Windows for process named whatsapp.exe - I have verified and it worked for me. 

Badge +2

We have face the similar issue and found this was due to the CASB restrictions only.

Userlevel 1
Badge +5

Greetings, you were able to replicate. I put the exclusion as you tell me but when I attach an image it is not sent.

Userlevel 3
Badge +11

Hello, I can see cert pinned app is created, is it also added to Steering Exceptions? 

 

Net result, you should see something along those lines in nsdebug log file:

 

2023/07/17 12:23:59.526 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: media-iad3-2.cdn.whatsapp.net 2023/07/17 12:23:59.791 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: media.fewr1-6.fna.whatsapp.net 2023/07/17 12:24:00.026 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: media-lga3-2.cdn.whatsapp.net 2023/07/17 12:24:14.026 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: static.whatsapp.net

 

 


@xavy2310 wrote:

Greetings, you were able to replicate. I put the exclusion as you tell me but when I attach an image it is not sent.

 

Userlevel 3
Badge +12

The problem arises when Netskope decrypts the domain "mmg.whatsApp.net". To resolve this problem, you can include this domain in the SSL decryption exclusion rule.

Reply