REDUH
This signature detects ReDuh, which is an application that proxies TCP connections over HTTP. This can be used to create a backdoor through a firewall that allows HTTP traffic.
Short Name
REDUH
Category
Web
SubCategory
Remote-Access
Risk
5
Release Date
--
Supported Platforms
Available to all SRX running 12.3X48+
Available to all MX running 20.2R1+
Available to all vSRX running 20.3R1+
Port
UDP/1900,TCP/543,TCP/443,445,UDP/443,8000,TCP/1433,TCP/1080,TCP/465,TCP/80,UDP/80,1434,UDP/4500,TCP/587,TCP/554,UDP/88,TCP/102,8080,UDP/5246-5247,3128,UDP/500,UDP/137,TCP/5445,UDP/554,TCP/139,UDP/135,TCP/993,TCP/135,TCP/995
Application Group
junos-approot:applications:web:remote-access:tunneling