whatsapp app

[xavy2310]

I am reviewing and I notice that when I use the WhatsApp app and attach an image it is not sent, I do not have associated blocking policies and additionally create a real-time policy where permission is granted to upload and download files.

If I enter through a browser, if it allows me to attach all the images, I wanted to check whether netskope restricts the sending of attachments through the App?

[borisgekhtman]

@xavy2310 what OS you are using for tests?

[xavy2310]

Windows 10 @borisgekhtman 

[borisgekhtman]

@xavy2310 I was able to reproduce it. Apparently fat client for Windows got certificate pinned recently. You should add certificate pinning exception for Windows for process named whatsapp.exe - I have verified and it worked for me. 

[xavy2310]

Greetings, you were able to replicate. I put the exclusion as you tell me but when I attach an image it is not sent.

[borisgekhtman]

Hello, I can see cert pinned app is created, is it also added to Steering Exceptions? 

Net result, you should see something along those lines in nsdebug log file:

2023/07/17 12:23:59.526 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: media-iad3-2.cdn.whatsapp.net
2023/07/17 12:23:59.791 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: media.fewr1-6.fna.whatsapp.net
2023/07/17 12:24:00.026 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: media-lga3-2.cdn.whatsapp.net
2023/07/17 12:24:14.026 stAgentSvc pe14 t22b8 info bypassAppMgr.cpp:601 BypassAppMgr Bypassing connection from process: whatsapp.exe, host: static.whatsapp.net

---

@xavy2310 wrote:

Greetings, you were able to replicate. I put the exclusion as you tell me but when I attach an image it is not sent.

[manishhtmedia]

We have face the similar issue and found this was due to the CASB restrictions only.

[Zulkifal]

The problem arises when Netskope decrypts the domain "mmg.whatsApp.net". To resolve this problem, you can include this domain in the SSL decryption exclusion rule.