(Bounty question at the bottom)
I'm having an issue with a client accessing our site, and the root cause is that the WAF (Web Application Firewall) doesn't like their User-Agent string:
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:34.0; C7QcSBPWTsrpX5YLvVZMqiujEZLWPtOYk3tDZ9WhW18=) Gecko/20100101 Firefox/34.0
In this case, the base64-encoded string is triggering a false positive in the WAF which thinks the User-Agent is libwww-perl. The base64 string does not decode to any readable text.
- Is having a base64-encoded string inside a User-Agent normal or unusual?
- Is the use of base64 strings inside a User-Agent covered by any RFCs or major vendor practices?
I'm trying to understand what's happening here; I don't feel the WAF signature is completely out of line to object, so I'd rather not just disable it, but I haven't seen this sort of User-Agent string before so I'd rather understand better how common and/or legitimate a use case this is.
The site is designed for use by humans with browsers - it's not an API or anything like that - and it has been reported to me that the user has tried accessing the site with "FF/IE/Chrome" and failed. I do, however, show successful connections from the same client IP with an Opera user-agent:
User-Agent: Opera/9.80 (X11; Linux i686) Presto/2.12.388 Version/12.16
It's a little odd that the user reports having tried IE but all the User-Agent strings I see appear to be Linux. (As usual, contact with the end user is mediated through several parties so I can't fully trust anything I hear). It's also likely the IP is the outbound side of a business class web proxy, which would explain why I see some Opera working for someone while someone else reports problems from the same IP.
Inspired by @PlanetScaleNetworks example, I googled the string and from there ended up using UA Tracker to search for base64 strings (or, the subset of them which were padded - I searched for "=)"). It returned about 20 User-Agents:
I'm going to add a bounty to this question, and the answer space I'm looking for is "what sort of software is putting base64 strings into User-Agents, and why? And is there any stamp of legitimacy for this practice?"
The user has worked around our problem by using a browser plugin to modify their User-Agent, so this is now an academic problem - but I think it's an interesting academic problem :)