Tera-WURFL and Firefox User Agent Switcher!!!

[rappadappa77]

Hello Everyone,

I'm new to tera-WURFL, but my problem is how can it detect more of a real mobile device, than someone actually using Firefox User Agent Switcher to trick your mobile website to seem like a real mobile phone, if something can be implemented or i'm missing something that can combat this?

Howard

[kamermans]

Hi Howard - Tera-WURFL relies almost entirely on the HTTP User Agent, so if this is masqueraded by something like the User Agent Switcher (side note, you can also change the user agent of Firefox, IE, Opera, Safari and Chrome without this addon) there is no way for Tera-WURFL to determine its authenticity. There is only one collection of information that you have to decide whether a request is coming from a mobile device - the HTTP Request Headers. This information can always be faked, although a decent line of defense would be to see what HTTP headers Firefox sends that shouldn't be present or are wrong. A good example might be the HTTP Accept header, although there are probably others.

[rappadappa77]

Hi Kamermans,

How would you setup the HTTP Accept header stuff, if that is possible?

[kamermans]

First, make a script like this:

Code: Select all

<?php
echo "<pre>".htmlspecialchars(var_export($_SERVER,true))."</pre>";
?>


Then, using the Firefox switcher with a mobile UA, visit that page and post the output here, then I can guide you to find a good request property to find and block. You can't blindly block certain HTTP Accept headers since they may be sent by valid mobile devices, but a combination of headers might help.

[rappadappa77]

Ok, thank you for your help, when i have actually setup Tera-WURFL on my server (I'm a newbie), i will definately post the results for you to checkout

[kamermans]

No problem! You don't actually need Tera-WURFL to do this part.

[rappadappa77]

Ok, so just cut and paste the code into notepad and put it on my server address and visit it with Firefox UA and it will tell me the info etc?

[rappadappa77]

Hi Kanermans,

I got a whole bunch of info, some will have to remain private, but i copied the user agent of a Blackberry Pearl Flip 8220, is that enough?
'HTTP_USER_AGENT' => 'BlackBerry8220/4.6.0.308 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/214',

[kamermans]

That's the field that get faked by the browser, the other fields that start with HTTP_ are the one you will need to look at.

[rappadappa77]

How, do i do that?

this is all the HTTP's

'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'HTTP_ACCEPT_CHARSET' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
'HTTP_ACCEPT_ENCODING' => 'gzip,deflate',
'HTTP_ACCEPT_LANGUAGE' => 'en-us,en;q=0.5',
'HTTP_CONNECTION' => 'keep-alive',
'HTTP_COOKIE' => 'SMFCookie463=a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A40%3A%228ee8ebfe46fe25c32e27b67aa579f11bbf2a1619%22%3Bi%3A2%3Bi%3A1477870346%3Bi%3A3%3Bi%3A3%3B%7D',
'HTTP_HOST' => 'www.mydomain.com',
'HTTP_KEEP_ALIVE' => '115',
'HTTP_USER_AGENT' => 'BlackBerry8220/4.6.0.308 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/214',