Blocking Among Us through the XG

Hi,

I've managed to block Among Us on both Android/IOS with a custom IPS signature, I didn't tested It with the steam version since I don't have It, but I believe It will also work.

While playing Among Us Online, It will establish a connection to the servers through UDP over a high port. (Such as 22023.)

You will have to create a custom IPS signature such as this one: (If you need help on this look at this document from Sophos.)

Example:

Here's the Custom rule content:

Edit: Here's the three signatures I've found, you can use any of them to block Among Us.

• content:"|4d 61 73 74 65 72 2d 36 2d 4f|";
• content:"|4d 61 73 74 65 72 2d 34 2d 4f|";
• content:"|4d 61 73 74 65 72 2d 33 2d 4f|";

Or you can play up with pcre and do something like:

• /\x4d\x61\x73\x74\x65\x72\x2d(\x36|\x34|\x33)\x2d\x4f/gmi

Example in plain-text:

• pcre:"/Master-(6|4|3)-O/";

After It you can apply on a IPS policy:

Here's how It should look like for the user after creating and applying the custom IPS signature on the traffic.

And here's how It looks like on the Log Viewer.

Thanks!

Hi,

I've managed to block Among Us on both Android/IOS with a custom IPS signature, I didn't tested It with the steam version since I don't have It, but I believe It will also work.

While playing Among Us Online, It will establish a connection to the servers through UDP over a high port. (Such as 22023.)

You will have to create a custom IPS signature such as this one: (If you need help on this look at this document from Sophos.)

Example:

Here's the Custom rule content:

Edit: Here's the three signatures I've found, you can use any of them to block Among Us.

• content:"|4d 61 73 74 65 72 2d 36 2d 4f|";
• content:"|4d 61 73 74 65 72 2d 34 2d 4f|";
• content:"|4d 61 73 74 65 72 2d 33 2d 4f|";

Or you can play up with pcre and do something like:

• /\x4d\x61\x73\x74\x65\x72\x2d(\x36|\x34|\x33)\x2d\x4f/gmi

Example in plain-text:

• pcre:"/Master-(6|4|3)-O/";

After It you can apply on a IPS policy:

Here's how It should look like for the user after creating and applying the custom IPS signature on the traffic.

And here's how It looks like on the Log Viewer.

Thanks!

Thanks Prism,

This is helpful - I was unsure if you could do custom categories via the IPS.

I will suss out the Steam version and see if I can't find it.

Have had no luck locating the SID for steam version.

Struggling to even find the traffic on XG.

Any tips on locating the traffic reliably?

You can do a pcap with wireshark on your computer while running the steam version of the game. This is the easiest method.

Also if you want to, you can send me the pcap later through a private message. (Please do at least 3-4 packet captures, this is extremely helpful when trying to find signatures over the traffic.)