topic Re: Block Web Links in Web based Email Portals in General Topics

Block Web Links in Web based Email Portals

MGoodnow — Mon, 13 Sep 2010 15:51:27 GMT

Hello,

Is it possible to create a policy that would block a user from clicking on an embedded URL link in an email from a web based email portal such as Yahoo or Gmail?

I am aware how to limit uploading and downloading of attachements through File Blocking. But still need to block the clicking of links. Could I create a Custom Signature for Vulnerability that looks for a URL redirect similiar to the Facebook article https://live.paloaltonetworks.com/docs/DOC-1540.

Due to the email worm outbreak of last week - I currently have a policy(s) that utilizes a block on all "Web Mail" as an application and the Bright Cloud URL catagory of "Web Mail". We are looking to lift that restriction to allow access back to web mail - with the exception of not being able to click on any links within the email if that is possible.

Thanks so much!

Cheers,

Mike

Re: Block Web Links in Web based Email Portals

mharding — Mon, 13 Sep 2010 16:19:00 GMT

The closest way I've seen to block this is by using RegEx. Most of the emails look the same, so you could use something like this:


.*(This\ is\ The\ Document\ I\ told\ you\ about\)
.*(This\ is\ The\ Free\ Dowload\ Sex\ Movies\)

Re: Block Web Links in Web based Email Portals

radpointsupport — Mon, 13 Sep 2010 16:52:35 GMT

Hi!

Why not do an custom apps for the mail system you want to block where the Referer is the email system and host header is not equals the email system.

Best regards Staffan

Re: Block Web Links in Web based Email Portals

MGoodnow — Mon, 13 Sep 2010 17:43:53 GMT

Thank you for the quick replies. I could see doing the regex entries if I know the actual web link text. And/or doing a custom app for a particular mail service. In my case I want to block (or at least not allow it to load in a browser if clicked on) any URL link that is within an email (not caring on the subject matter) - and need to do this for all the mail services. I'm taking advantage of the application group "webmail" and the Brightcloud "webmail" group - so that I don't have to manage all the hundreds of webmail portals. Thanks.

Mike