Zero Phishing and IOS 18.4: Captive Portal Problem

Masek

Hi,

if you have R82 and Zero Phishing active on a gateway (I know, not the most common setup), you may run into a problem I just had.

An iPhone or an iPad updated to IOS 18.4 will no longer be able to connect to a WIFI that is secured by a firewall described above.

The culprit in this case: Zero Phishing:

curl http://captive.apple.com/`

[HTML>[HEAD>[TITLE>Success[/TITLE>[/HEAD><BODY><script nonce="***">var zphInj="***"[/script>[script nonce="***" src='http://zero-phishing.iaas.checkpoint.com/zph/token_generator.php?api_key={***}' crossorigin>[/script>[script nonce="***" src='https://zerophishing.iaas.checkpoint.com/3/zp.js?api_key={***}' defer crossorigin>[/script>Success[/BODY>[/HTML>

(info: replaced all "<" by "[" to be able to post)

Prior to IOS 18.4, my iPhone had no problem with that reply, but with IOS 18.4 it hangs with this screen:

It no longer recognizes the "SUCCESS" due to the SCRIPT-Tag from Zero Phishing.

I don't need a solution, disabling the blade was a quick fix. I know how to create exceptions.

But I guess this will hit several people who don't know what hit them. As the update on IOS triggers this, I looked in Apple's direction first (and not completely wrong to do so). I opened an SR to give CP a heads up as I will not be the last one to stumble over this.

JHF was 12 in my case.

Yours, Martin

I don't know where I'm going, but I'm on my way

PhoneBoy

Appreciate you sharing this tidbit in case others run into it.
Hopefully it will be addressed in a future JHF.

Masek

I am quite optimistic on that. This will cause a lot of SR cases. Advised my contacts in the support team on the incoming wave. I‘m glad I ran into this one early, so it may do some good.

I don't know where I'm going, but I'm on my way

Sören

The workaround is to add an exception to the threat prevention policy.

1. Under "Custom Applications/Categories" -> Application/Site -> Create an object for example: AppleCaptive
2. Add "captive.apple.com" to the Application object "AppleCaptive".

3. Create an exception

Masek

As I wrote, I know how to create an exception. This post was meant as something Google finds when you're looking for the problem. This has the potential to keep less experienced admins to scratch their heads 😁.

I don't know where I'm going, but I'm on my way

Are you a member of CheckMates?

Zero Phishing and IOS 18.4: Captive Portal Problem