Android Mobile App is triggering some force brute scenarios in Coraza and Crowdsec

Mobile Apps Home Assistant Companion for Android
1

Hello

I’ve been using HA (raspi4) and the mobile app for many years.
I have a public access and recently I’ve installed a caddy reverse proxy with coraza WAF and Crowdsec

Since I have it when I access using the Android App, two scenarios are triggered and my IP is blocked.

This only happend with Android App (I have a Pixel 7), I can access via web using the same mobile or using the IOS App without any problem.

These are the triggered scenarios, all related with force brute prevention

LePresidente/http-generic-403-bf

"Alert when a single IP that try to bruteforce http basic auth.

Leakspeed of 10s, capacity of 5."

barnoux/crs-anomaly-score

" * Inbound anomaly score detection"

I’m using the latest Android app version.

I’ve disabled the backgroud sync with the same results.

Thank in advance

2

you should disable those checks for teh app, the app is not doing anything brute force. The app needs to not have anything blocking it in your setup.

1 Like
3

I’ve tried configure the app but I haven’t seen any settings for this.

I only see 1 setting in HA, I have the the sensor update every 15 minutes but nothing in the app configuration.

4

not in HA, in your network setup. Make sure teh app has free access without anything blocking it.

5

I think probably in not explaining correctly.

I can use the android app, what I say is that the way it works generate more than a request per second in my server so when I enable coraza or crowdsec they detect it as a force brute attack.

It not happens if I use Chrome (in the same mobile) or the IOS app, in both cases the server does not receive as many requests per second and using these other access methods does not trigger security scenarios.

I connect always to the same server and it shows the same panel.

6

Hi again

I’ve solved the problem adding an exclusion in the Coraza rules.

7

This is the exception to the triggered rule in case it is useful to someone.

SecRule ARGS:json.data.unique_id “@rx .*”
“id:100004,
phase:2,
pass,
t:none,
ctl:ruleRemoveTargetById=933150;ARGS:json.data.unique_id”