Curious if anyone else who uses Crowdstrike (or other anti-malware products) has seen this?   We just upgraded a PSA3000 to Connect Secure v9.1R16 (build 20059) and upgraded ESAP to v4.0.4.   On our remote laptops we connect to the vpn using a web browser ("browser client") and that causes Pulse Secure Application Launcher (PSAL) to launch.   Almost immediately the Crowdstrike agent on the remote laptop began to detect files as "malicious".   This is during the portion where PSAL downloads the newer files from the Connect Secure appliance.    Initially one file was detected and quarantined, so we added an exception and tried to connect again only to have two more files detected and quarantined.  We have a ticket open with Pulse Secure tech support and waiting for their feedback.   In addition to Crowdstrike, at least one other anti-malware product also detects these files as malicious.   PSSetupClientInstaller.exe https://www.virustotal.com/gui/file/35ff83f6c044dfd621c0a0c95626d934b099e729bdd27f100f82f909fdef9a26/detection   PulseSetupXP.exe https://www.virustotal.com/gui/file/c6cdaf0edb5f9d701372a8303cb118acce5bd07786acb7d390274a2f58f8281d/details   dsHostChecker.EXE https://www.virustotal.com/gui/file/63e351b089edf2288d6a3c56e176687eb4511cb6042566c3e4946a42f22978f0/detection     ... View more

Friends, Can I ask your advice and thoughts on how susceptible a user is to falling victim to a man-in-the-middle attack, or a evil twin attack, when using a VPN connection from public WiFi such as a coffee shop or hotel? Have you come across any KB from Pulse Secure on this topic, or know of any good information on the Internet, or care to share your own perspective?    I have found many documents and articles on the Internet which warn of the danger of using public WiFi and they all recommend to “use a VPN”.   But they don’t explain at a technical level what they mean by “VPN”.   For example with Pulse Secure it is possible to use SSL VPN (web browser as the client), or use a IPSEC VPN (Pulse Desktop as the client).     My gut feeling is an SSL VPN is susceptible to MITM, and an IPSEC VPN is still susceptible but not as much.  Is this accurate?  Is there any technical documents which explain this?  Please correct me if I am wrong.   My company uses SSL VPN with the browser as the client.  Lets say a user is at a coffee shop and connects to an evil twin access point.   The access point will assign the laptop an IP address, default gateway, and DNS Servers.   Since DNS is under the control of a hacker anything the user enters into the browser can be redirected to a malicious web site.  If the user enters https://vpn.mycompany.com into the browser, the hacker can intercept this, easily screen scape the real vpn.mycompany.com web page, and then present a fake web site to the user.  I believe the user would see an SSL certificate warning from the web browser (since the hacker’s web site doesn’t have the real SSL cert) but we know users are quick to bypass these warnings.   As technical admins we would also notice that Host Checker doesn’t run, but the average user wouldn’t notice.  The user could believe they have connected to the real vpn.mycompany.com page and enter credentials.   The hacker can intercept all the traffic thus using two-factor authentication won't prevent this type of attack.   The overall goal here is to present to management the risk of MITM risks when using public WiFi.  And if there are any ways to mitigate those risks.  Thanks in advance for your feedback! ... View more

Hello, I have been reading the list of deprecated features in version 9.1R15 (https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB45044) , including a very brief note about Cache Cleaner: "For User Roles, under Host Checker restrictions remove cache cleaner policy from selected policies list"   Just upgraded a PCS appliance to 9.1R15 and sure enough the Cache Cleaner page is gone.   Under Authentication --> Endpoint Security there is no longer a page for Cache Cleaner.   What is the impact of no longer having Cache Cleaner?   Was it not providing any benefits?  Thoughts? ... View more

In KB44781 there is a link to download the uninstaller file named UninstallPulseComponents_V2.  The URL for the link is https://corpfiles.pulsesecure.net/share/[email protected]@@QrPLIQYlg==p?dn=1. That corpfiles site isn't responding for us from several differerent locations (different Internet connections - home, office, etc).  Anyone having luck getting to this web site? ... View more

In October 2020 Pulse Secure released firmware v9.1R9.  A new feature introduced in this version is the ability to carry microphone (audio input) from the local computer (the computer initiating the VPN connection) to the remote computer.   Has anyone used this new feature?  Just curious what your experience has been?   We recently upgraded to this new firmware, and four I.T. administrators including myself performed several rounds of testing with microphones on our home laptops.  There was a significant lag of three to four seconds between when one person would speak and the others would hear the words.  Since these are I.T. admins I feel comfortable that they have decent Internet service and higher-end Wifi / network equipment.  We tested using Zoom, Teams, and other call center software.   I realize this is a new feature for Pulse Secure so further updates may fix issues.  If anyone has suggestions on ways to improve audio quality I would appreciate any ideas.   -Fred   ... View more

For a while (perhaps several years) when using the Chrome browser a user would constantly get the Pulse Secure Application Launcher (PSAL) pop-up window.  This was due to Google removing a protocol handler feature from the Chrome browser.  Today I upgraded to Chrome v84.   After the upgrade when I connected to the VPN inside the PSAL pop-up there was a checkbox to allow the browser to automatically open PSAL.  And sure enough when that box is checked I no longer get the PSAL pop-up.    I did a quick review of the Chrome release notes and blog sites but can't find any information about a change to the protocol handler.   Is anyone else seeing this same behavior in Chrome v84 ? ... View more

Is there a way to use Host Checker to verify a Windows 10 computer is either a) fully patched b) running a specific release of Windows 10 (for example version 1909 which was released in Nov 2019)   We already have a Host Checker policy which checks the operating system to verify the remote computer is running Windows 10.  This works fine.  But we would like to be more granular and only permit remote Windows 10 computers which have up-to-date patches installed. ... View more