topic File blocking not working with Hotmail in General Topics

File blocking not working with Hotmail

k.dimitrovski — Wed, 08 Jun 2011 10:35:37 GMT

I've tried to use the file blocking option to ban attachments on Hotmail. But it's not working on me.

1. Created file blocking profile for hotmail application, certain file types and chose both directions -> block.

2. Created security rule with my IP as a source and hotmail, ssl, web-browsing in applications (added these after the warning on commit), any service, action allow and the file blocking profile selected in Individual profiles...

3. The rule is on top, and if I chose block I can't browse the web, so this is the rule that "catches" my traffic.

Tried and the attachments are working fine...

Am I missing something? Any suggestions?

Best regards,

Konstantin

Re: File blocking not working with Hotmail

mderksen — Wed, 08 Jun 2011 11:57:25 GMT

Most of the hotmail file downloads happen via SSL. You can check the application in the traffic log. If you want to inspect the hotmail part you need to enable ssl inspection.

Also if hotmail is using a java enabled up and download this can keep the scanning from working.

Marcel

Re: File blocking not working with Hotmail

k.dimitrovski — Wed, 08 Jun 2011 12:14:22 GMT

Marcel,

I actually did an Wireshark capture of the file transfer and it's over http (port 80).

I can even see the following data when I do decode on the stream (to host du101w.dub101.mail.live.com - 94.245.116.7):

Referer:http://msc.wlxrs.com/poBCDexPyDTmZU!g1!Ku5AkCPPjLAp!IHrxFrh9VuKRu7mzDkQY3SbPGkjTKUo4L/Microsoft.Live.Silverlight.HotmailUploader.xap

Content-Length: 960997

Content-Type: application/x-www-form-urlencoded

filename: HwQgBBUEFAQbBB4EEwQgACIEFQQlBB0EGAQnBBoEHgQgACAEFQQoBBUEHQQYBBUEIAAXBBAEIAARBBUEIgQeBB0ELgBwAGQAZgA=

silverlightupload: true

%PDF-1.5

%....

1 0 obj

<</Type/Catalog/Pages 2 0 R/Lang(mk-MK) >>

endobj

2 0 obj

<</Type/Pages/Count 9/Kids[ 3 0 R 19 0 R 31 0 R 38 0 R 41 0 R 44 0 R 50 0 R 53 0 R 55 0 R] >>

endobj

3 0 obj

<</Type/Page/Parent 2 0 R/Resources<</Font<</F1 5 0 R/F2 10 0 R/F3 12 0 R/F4 14 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.32 841.92] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S>>

endobj

4 0 obj

<</Filter/FlateDecode/Length 4242>>

stream

x..\[k,.

~?p.....w...`.f<;!!..9oK.r9..l.!....ERI..q.a9k...J%..O....._~y.O6L&<}.../.......O

and at the end I can see:

$p.OV....^.....V.|..x..v...."[;.;:.n...._2.....8E...y.m...y.Ywe...@C.....].9....^..(*...s...j.b.Q.}FpD............nb..
,..cq<G/...Zd.pU..}...Zf...<..+.........k\^..yMIP9./IR..}.[2........,"#r-........S7E."..<.<g..m..&5}:@.p.....I....uG[...9.Z.....I*.
.."..Mpx...g."....1..
endstream
endobj
81 0 obj
<</Type/XRef/Size 81/W[ 1 4 2] /Root 1 0 R/Info 58 0 R/ID[<8B702CF0E319FF4598A4B5ECC7CE03F2><8B702CF0E319FF4598A4B5ECC7CE03F2>] /Filter/FlateDecode/Length 289>>
stream
x.%..+.q....w..kH.....b......Zsr.2.7.......HJ.8hJ.Ejq.FrqP.EI)r.#.r.....>......~+U-.5....&)..Q.;
.G....9...p.-e.-@...(.@[Fx..[pL....%.I......B.........u..(....|;c./.~i...L..1s...p........{......+.|.\'...).j..?.1.....#.........Zc.|......./.@Ac.1...5.&....
...k.R.0..J...Z.D
..P.c..!aB...[D.
endstream
endobj
xref

So does this give you any valuable information?

Best regards!

Re: File blocking not working with Hotmail

mderksen — Wed, 08 Jun 2011 16:07:21 GMT

Looks like it is using silverlight to do the filetransfer.

I would suggest to create a case and see if we can inspect the silverlight file transfers.

We might be able to detect the silverlight upload and create something for this.

Marcel