PCI - Credit Card Numbers does not block traffic

[Arend]

Hi,

When running a test to block credit card numbers leaving the LAN towards the internet using Content Awareness no hits on the credit rule (with inline layer) is being matched

The below general HTTP/HTTPS rule is being matched instead.

Any idea why entering credit cards on shopping sites in combination with this default "Pattern (RegEx) Data" called "PCI - Credit Card Numbers" is not working?

[the_rock]

Just to make sure I understand, are you saying rule 8.2 is supposed to be matched, but instead its hitting 8.1?

Andy

[Arend]

Hi Andy, rule 8 is supposed to be matched and consequently the inline rule of either 8.1, 8.2 or a drop if not matched.

But now it skips rule 8 and does hit on rule 9 which is a general HTTPS rule.

I use my own real Mastercard

[Timothy_Hall]

For testing are you using a "real" credit card number that conforms to the Luhn algorithm?  Valid credit card numbers are not just 15 or 16 random numbers.  Try this one which conforms in your testing: 4242 4242 4242 4242.  This is an easy one to remember because it is the answer to life, the universe and everything.

[the_rock]

Never heard of that before, but good to know thats number used for testing : - )

Below is what I got from Google ages ago lol

4111 1111 1111 1111 for Visa, 5431 1111 1111 1111 for MasterCard, 3711 1111 1111 114 for Amex, and 3600 0000 0000 08 for Diners

[Arend]

Do any of you in your own LAB have a nice outbound hit on a CC with the content column as "PCI - Credit Card Numbers" ?

[the_rock]

I did when I had content awareness blade enabled. By the way, credit card numbers layer (rule 8), shows you are missing clean up rule, but should ne a big deal in this context, since that simply means you dont have any any drop rule at the bottom, but as it shows there, unmatched traffic would be dropped anyway. Just curious, how many hits do you see on rules 8.1 and 8.2?

Andy

[Arend]

I use my own real Mastercard but will try the answer to life as well.

[the_rock]

Also, something to consider.

Andy

https://community.checkpoint.com/t5/Management/Content-Awareness-things-that-do-not-work/m-p/139442