Psiphon

Description

This indicates an attempt to access Psiphon.
Psiphon is a censorship circumvention tool from Psiphon Inc. It uses various communication and encrypted protocols like QUIC, SSH, SSL, HTTP Proxy to tunnel traffics through a firewall. It is designed to support users with heavy censorship in their country. The concept was developed by Citizen Lab. It is one of the most popular proxy app today.
Note: Psiphon requires setting the QUIC signature and proxy category to block.
SSL deep inspection is required for some of the versions to get 100% block rate. When deep inspection is enabled, please turn off "Replacement Messages for HTTP-based Applications" in application sensor if you are on FortiOS 5.4 or 5.6.

Affected Products

Psiphon

Impact

Firewall policy avoidance

Technology

Client-Server

Behavior

• Evasive
• Tunneling

References

• https://s3.amazonaws.com/fddc-r090-rtqi/en.html