Identify and Block Malicious Traffic Using JA3/JA4 Fingerprints in Auth0

Auth0 Attack Protection features mitigate malicious attempts to access applications, but sophisticated attacks using multiple IP addresses can still consume rate limits and increase tenant log volume. Network-level blocking of malicious traffic based on JA3/JA4 fingerprints provides an alternative to traditional IP blocking. Identify JA3/JA4 fingerprints in tenant logs or action triggers and create a tenant access control list rule to block the associated traffic.

• Auth0
• Attack Protection
• Tenant Access Control

Sophisticated attack actors use multiple IP addresses across a wide variety of geographies as the source of malicious traffic. This avoids more traditional blocking of traffic based on individual IP addresses or IP address ranges.

What are JA3 and JA4 fingerprints?

If an investigation into a potential attack concludes that an attacker uses multiple IP addresses concurrently or rotates from one IP address to another when a specific IP address is blocked explicitly, blocking malicious traffic based on JA3/JA4 fingerprints is an available alternative. JA3 and JA4 are methods for creating fingerprints of clients who initiate secure connections using Transport Layer Security (TLS) or Secure Sockets Layer (SSL). They help identify applications, even if those applications spoof their identities or change their IP addresses.

Where do JA3 and JA4 fingerprints appear?

The attack protection playbooks provide steps to identify bot traffic and investigate potential attacks using tenant logs. A JA3/JA4 fingerprint is available in supported scenarios within specific tenant log types. Specifically, a ja3 and a ja4 field are available within the security_context object. Use the auth0-log-schemas repository to confirm which specific tenant log types include this information.

Review the event objects of the following action triggers to locate JA3/JA4 fingerprints for the ongoing transaction.

• Login trigger
• Pre-user registration trigger
• Post-user registration trigger

NOTE: The fields are optional and may be absent. JA3/JA4 are fingerprints of the client’s TLS handshake, so they are mostly relevant in tenants where Auth0 acts as the network edge for public traffic. In a tenant using a self-managed certificate custom domain, JA3/JA4 fingerprints for requests performed through the custom domain reflect the fingerprint of the reverse proxy used in implementing the custom domain and are not helpful for network blocking.

What steps create a tenant access control list rule to block JA3/JA4 fingerprints?

After determining the JA3/JA4 fingerprints associated with a potential attack using either tenant logs or extensibility, create a tenant access control list rule that uses a match condition on the applicable ja3_fingerprints or ja4_fingerprints.

Configure a rule using the Management API endpoint (Create Access Control List) to block authentication-related traffic associated with a specific JA4 fingerprint by applying the following JSON payload.

{
  "description": "Block authentication traffic from malicious JA4",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "ja4_fingerprints": ["t13d201100_2b729b4bf6f3_9e7b989ebec8"]
    },
    "scope": "authentication"
  }
}