WhatsAppWeb attachments

[DptoRedes]

Hi, I've been trying to create a rule wich blocks all the attachments on a WhatsAppWeb conversation but ain't got success.

It's really hard to see all the connections because the traffic it's encrypted and i can't see nothing on troubleshooting. I try to exclude the URL in 'SSL No Decrypt' list but, this way, i can't even log on (not appears de QR code).

The Rule I created it's defined with the following criteria:

URL.Host matches
mmx.cdn.whatsapp.net

*web.watsapp.com*

*mmg.whatsapp.net*

AND

Authentication.UserName equals [my user]

AND

MediaType.EnsuredTypes at least one in list [file list set on my own]

Please, I need help, any recommendation?

Thanks.

[aloksard]

Hi,

Hope you are doing well.

While accessing WhatsApp through browser , an QR code needs to be scanned.

While accessing https://web.whatsapp.com/   QR code is being required which is seen to be working on Web Socket protocol which does not work with SSL Scanner enabled.  You can import our Web Socket handling rule set and add *web.whatsapp.com*  in it.

MWG cannot get granular filtering for WhatsApp, because: -

Whatsapp uses "blob" type of URL to do this task cleverly. 'blob' URL is nothing but a form of javascript, usually starts with the syntax blob followed usual https URL that refer to the temporary location where the file is saved . The file may be a text message, thumbnail or image 

If you enable SSL Scanner for whatsapp traffic, then it will have issues as in web.whatsapp there is an QR code which first needs to be scanned. Which does not work as it uses web socket protocol. You will have to import web socket rule from rule set library and add URL *web.whatsapp.com* in it.

We can only achieve what is mentioned in below links for WhatsApp filtering :-

https://support.symantec.com/en_US/article.TECH246174.html

https://www.linkedin.com/pulse/how-can-i-stop-whatsapp-from-uploading-files-hasan-jradi

WhatsApp Upload control and text messages are handled by chat servers associated to the domains {c|d|e}X.whatsapp.net (X is an integer changing for load balancing), whereas multimedia contents are handled by multimedia (mm) servers associated to the domains "mmsXYZ.whatsapp.net" for audio transfer, "mmiXYZ.whatsapp.net" for photo transfers, and "mmvXYZ.whatsapp.net" for videos

To stop Whatsapp from sending media or document files, You can create a rule to block and redirect any request to mm*.whatsapp.net* and pp*.whatsapp.net*

Regards

Alok Sarda

[ISF]

Hi,

in order only to login and text in WhatsApp web, but block any type of media or document.

You can use URL Filtering rule set, select the rule Block URLs That Match in URL Blocklist.

add multiple wildcard expressions:

*me**.fna.whatsapp.net*
*me**.cdn.whatsapp.net*
*mmg.whatsapp.net/*mode=auto&mms-type=image&__wa-mms=*
*mmg.whatsapp.net/*mode=auto&mms-type=video&__wa-mms=*
*mmg.whatsapp.net
*mmg.whatsapp.net/*=manual&mms-type=image&__wa-mms= whatsapp web files download block
*mmg.whatsapp.net/*=manual&mms-type=video&__wa-mms= whatsapp web files download block
*mmg.whatsapp.net/*=auto&mms-type=thumbnail-link&__wa-mms=
*mmg.whatsapp.net/*=manual&mms-type=thumbnail-link&__wa-mms=
*mmg.whatsapp.net/*=auto&mms-type=document&__wa-mms=
*mmg.whatsapp.net/*=manual&mms-type=document&__wa-mms=