topic Re: Blocking images with EXIF data in General Topics

Blocking images with EXIF data

chrisdduncan — Fri, 15 Nov 2013 18:54:26 GMT

I have a customer that wants to block outbound images that have EXIF data (gps coordinates). Can this be accomplished with a customer app-id doing a pattern match perhaps?

Re: Blocking images with EXIF data

Phoenix — Fri, 15 Nov 2013 19:32:50 GMT

Hello chrisdduncan,

Yes if the customer can create a custom application after analyzing the data pattern and loading that as a signature in the custom app and block it as needed.

I have seen in file blocking profile that I do not find a file type exif. But if this can be caught as a signature then yes we can have control over it.

Thanks

Re: Blocking images with EXIF data

mikand — Sun, 01 Dec 2013 17:15:18 GMT

Please send me a PM (or even better put it online in this thread 🙂 in case somebody has already created such IDS signature for PA. That is images containing EXIF data (or more specific containing geolocation EXIF data).

Re: Blocking images with EXIF data

mbutt — Mon, 02 Dec 2013 19:15:10 GMT

Hi,

I would suggest to post the question in dev center community.

It is"the online community for customers, partners, and employees to share custom content including Custom App-IDs, Custom Threats, Custom Reports, XML API integration, CLI scripts, and other tools. Use the discussion threads to ask questions and receive help from other members. The current samples would be a good start. "

There might be someone already who has worked on this app. Also you can submit a request for new app. The following link explains on how you can do that

https://live.paloaltonetworks.com/docs/DOC-1879

Hope this helps.

Regards,

Numan

Re: Blocking images with EXIF data

ymiyashita — Tue, 03 Dec 2013 07:19:33 GMT

I guess it's not possible to do pattern match because what you'll do here is to look for EXIF tag IDs for GPS but they are less than 7 bytes.

0x8825 : GPSInfoIFDPointer

0xF4240 : GPSVersionID

etc

- Yasu