[Thorough explanation] Professionals explain WAF false positive patterns and causes!

Basic Mechanisms of WAF False Positives

The WAF analyzes the content of the request in detail and detects threats based on predefined rules. However, WAF rules are often designed with a "suspicion penalizes" mindset, which can lead to false positives because:

1. Limitations of Pattern Matching: Detection based on specific string or regular expression patterns fails to understand context
2. Breadth of rules: Comprehensive rules for catching a wide range of attacks, down to successful requests
3. Update frequency issues: rules that don't support new use cases or technologies

 

False positives that are likely to occur in input forms

1. Examples of Personal Names and Addresses with Special Characters****

When a customer enters a form with the following information, the WAF blocks:

• 'O'Connor' (surname with apostrophe)
• '1+2-3-4' (phone number with plus sign)
• 'Straße' (address with special German characters)

Reasons for technology
These special characters (''', '+', 'ß', etc.) are also used in attacks such as SQL injection and XSS, so they get caught in WAF rules.

2. Examples of uploading programming-related questions and technical documents****

Blocking when you submit the following content in a technical support or contact form:

• 'SELECT * FROM users WHERE id = 1' (question with SQL syntax)
• ''' (question with JavaScript code example)
• Upload text files with program code

Reasons for technology
These strings match the patterns of SQL injection and XSS attacks as they are.
Because the WAF can't understand the context, it also considers legitimate technical questions to be attacks.

3. Examples of SQL-related keywords in addresses and names****

Block when you enter a name or address such as:

• 'Tom Select' (a name containing the SQL keyword 'SELECT')
• 'Drop Street' (address with the SQL keyword 'DROP')
• '1 Union Square' (address with the SQL keyword "UNION")

Reasons for technology
Anti-SQL rules perform case-insensitive keyword matching, which blocks legitimate names and addresses.

4. Examples of Setting Complex Passwords****

Blocks when you enter a complex password when setting a password, such as:

• `P@ssw0rd!<>2023' (password with special character '<>')
• 'Test'Password!123' (password with apostrophe)
• 'Admin/123/' (password with comment symbol)

Reasons for technology
For security reasons, it is recommended to use special characters for strong passwords, but many of these special characters are also used in XSS and SQL injection attacks.

5. Examples of Inputting Multibyte Characters in Japanese, Chinese, etc****.

Form submissions containing non-ASCII characters such as Japanese or Chinese are blocked:

• 'Taro Yamada' (Japanese name)
• 'Shinjuku-ku, Tokyo' (Japanese address)
• '张伟' (Chinese name)

Reasons for technology
URL-encoded multibyte characters may be falsely positived as a special sequence of characters.
In addition, the conversion of character codes can also inadvertently generate dangerous patterns.

False Positives in Search Forms

1. Complex search query case with AND/OR operator****

Search queries such as the following are blocked:

• 'red AND blue OR green' (search with logical operators)
• 'Reason for 'price > 1000 AND price < 5000`（比較演算子を含む検索）
• product:"iPhone" AND NOT category:"case"（高度な検索構文）

technology
These logical operators are also used for SQL injection attacks, so they violate the rules of the WAF.

2. Examples of Tech Forum Posts with Code Snippets****

Posts on tech forums and QA sites block the following:

• PHP code snippet: ''
• Description with HTML tags: '
  `
• JavaScript example: 'document.getElementById('demo').innerHTML = '';'

Reasons for technology
These code snippets contain patterns used for XSS attacks and HTML injection.

Contact Form False Positives

1. Feedback and support request examples with URLs****

Feedback and support requests with URLs like these are blocked:

• 'Problematic page: https://example.com/product?id=123'
• 'I referred to the following site: http://tutorial-site.com/how-to'
• 'URL with error: https://yoursite.com/checkout.php?session=abc123'

Reasons for technology
The parameters and path structure contained in the URL may match various attack patterns. False positives are especially likely to occur when they contain suspicious parameter names or values.

2. Examples of explanatory texts with HTML tags****

Feedback with HTML tags like the following is blocked:

• 'Site's
  tag is not closed correctly'
• 'Tag alt attribute doesn't seem to be set'
• 'Error message: <Error: connection="" failed="">`

Reasons for technology
HTML tags are a fundamental element of XSS attacks, so they are heavily filtered by WAF.

False positives in advanced search filters

1. Examples of Specifying Complex Date and Numeric Ranges****

Filtering by the following search criteria is blocked:

• date >= '2023-01-01' AND date <= '2023-12-31'="" *="" price=""> 1000 AND price < 2000
• quantity BETWEEN 5 AND 10

Reasons for Technology
These conditional expressions use similar syntax in SQL injection attacks, making them more prone to false positives.

2. Use Cases for Special Search Syntax

Special search syntax such as the following is blocked:

• "exact phrase" -exclude +must_include
• author:"John Smith" category:fiction
• tag:security AND published:2023

Reasons for technology
These special syntax contain quotes and operators, which can align with various attack patterns.

Best Practices for Reducing WAF False Positives

Before applying the new WAF rules to the production environment, you can reduce false positives by operating the new WAF rules for a certain period of time without blocking communication, such as "detection mode", and scrutinizing the logs and performing tuning.

By creating elaborate exception rules for specific URL paths, parameters, and operations, you can maintain a level of security while reducing false positives.

Tuning your WAF doesn't just need to be done at the time of deployment.
You should regularly analyze your WAF logs to identify and adjust the rules that are causing false positives.
Keep an eye on it, especially after a new feature release.

How to Use SOC Services for WAF Operations

Continuous monitoring and adjustment are essential to effectively address false positive issues in WAFs.
It would be better if we could implement it ourselves, but we often hear that we don't have enough resources to deal with it.

By leveraging SOC (Security Operation Center) services, you can get the following benefits:

1. Expert Monitoring and Analysis
   • Early identification of false positive patterns
   • Appropriate rule adjustments for context
   • Respond to new attack methods
2. Incident response and rule optimization
   • Rapid response in the event of false positives
   • Continuous rule tuning
   • Regular security reviews
3. Integrated Security Management
   • Integration of multiple security measures such as WAF, Firewall, IDS, etc.
   • Consistent security policy enforcement
   • Comprehensive threat visibility

Summary: For a Balanced WAF Operation

False positives in WAFs are an unavoidable challenge in balancing security and convenience.

Keep the following points in mind:

1. Thorough understanding of the intended use case
   • Understand the normal usage patterns of your site and application
   • Consideration of the possibility of special user input
2. Step-by-Step Security Implementation
   • Gradual transition from monitoring to blocking
   • Protection level settings based on criticality
3. Continuous Monitoring and Improvement
   • Identify false positives through log analysis
   • Leverage user feedback
   • Regular rule review and optimization
4. Leverage Expertise
   • Utilization of external experts such as SOC services
   • Collect and apply the latest security information

Colorkrew Security's SOC services provide specialized monitoring, analysis, and tuning for false positive issues in WAFs. We support various WAF platforms, including AWS WAF, Azure WAF, and more, to help you maintain the right level of security without disrupting your business.

If you are a company that is struggling with false positives in WAF and are looking for an effective way to operate a WAF, please contact Colorkrew!
With our extensive experience and expertise, we can help you balance your business and security.</=>