topic Re: How to block additional file types? in General Topics

How to block additional file types?

jeijgensteijn — Thu, 22 Oct 2009 15:15:34 GMT

Hello guys,

Can you please advise how we can restrict access to file types such are .vbs and .msi?

These types are not available in the File block list.

Kind Regards,

John

Re: How to block additional file types?

mjacobsen — Thu, 22 Oct 2009 15:44:42 GMT

John,

We just added MSI to this weeks content release. You should see it

show up if you upgrade to content update 150. We don't currently have

support for VBS files but we can take a look at adding support for

them in a future content release.

Mike

Re: How to block additional file types?

jeijgensteijn — Fri, 23 Oct 2009 11:46:51 GMT

Thanks for the quick reply, I've just updated and added .msi to the block list.

Would it be possible to investigate if the following file types can be blocked?

.ade

.adp

.bas

.com

.cmd

.cpl

.lnk

.htr

.msh

.wsh

.wsf

.vbe

.vb

.shs

.scf

.scr

.msp

.mst

.isp

Many thanks,

John

Re: How to block additional file types?

charlespkoenig — Thu, 19 Nov 2009 15:49:25 GMT

I'd like to add .xap files. Silverlight uses these.

Re: How to block additional file types?

fredallee — Thu, 19 Nov 2009 19:53:01 GMT

Charles,

Thanks for the suggestion. Can you tell me how controlling xap files differs from controlling silverlight as an application via App-ID?

Alfred

Re: How to block additional file types?

migration — Fri, 13 Aug 2010 13:16:30 GMT

Hi Alfred,

I have noticed the file transfer blocking doesn’t work as expected. If a rule is in place blocking any file transfer using gmail or any other web-mail (Gmail not GTALK file transfer), it doesn’t work for file-types apart from the once mentioned in the list e.g. .TXT, .PCAP etc. If I select "ANY" as an option, that should block any attachments irrespective of the file-type or the extension. Even if PAN NGFW manages to block it, using a classic uploader option on gmail, the file goes right through. This is just a matter of checking a check-box on the settings page of the Gmail account, which an end user can easily do. I have tried the same with multiple web mails, attachment blocking doesn’t work for non listed file types, when the file type is selected as “ANY” in the file blocking profile.

Any advice would be appreciated.

Regards,

Sumukh Rao

Re: How to block additional file types?

jleung — Sun, 15 Aug 2010 16:15:25 GMT

Hi Sumukh,

As I told you, any means any of the below file types. It is a bit misleading.

Jones

Re: How to block additional file types?

rmonvon — Mon, 01 Nov 2010 15:24:36 GMT

Enclosed is a custom appID to detect for .jpg images. The signature is looking for the end of the URI path and matching on the string ‘\.jpg HTTP’ without the quote. This will work for web-browsing apps only, and a typical web request would look like this:

GET .../images/twitter_corp.jpg HTTP/1.1\r\n

GET .../pictures/logo.jpg HTTP/1.1\r\n

You can import this appID into the PAN device under Objects ==> Application. Once verified, you can clone the app and change the app signature to match other file types like .scr, .pif, etc.

Re: How to block additional file types?

rahmant — Tue, 02 Nov 2010 00:28:23 GMT

Are you decrypting the Gmail session so that the PA unit can actually see the upload?

Tariq

Re: How to block additional file types?

KateAdetola — Fri, 11 Aug 2017 11:55:03 GMT

Hi,

Is there any update on blocking the below list of file types please?

Thanks,

Kate.

Re: How to block additional file types?

reaper — Fri, 11 Aug 2017 12:03:43 GMT

Kate

this is a pretty long list, are you looking for a specific filetype ?

Re: How to block additional file types?

kiwi — Fri, 11 Aug 2017 12:07:16 GMT

Hi @KateAdetola,

To see the current list of supported file types you can search the 'File Type' column in the File Blocking Profile. You'll see that the list has grown considerably :

File Types

Alternatively you can check out the following article :

Supported File Types

Cheers !

-Kiwi.

Re: How to block additional file types?

KateAdetola — Fri, 11 Aug 2017 13:15:03 GMT

Hi,

Yes I am specifically after .msp file types, as we woild like to block end users from downloading and installing .msp files. This is not on the list of supported files currently.

Thanks,

Kate.

Re: How to block additional file types?

KateAdetola — Fri, 11 Aug 2017 14:27:55 GMT

Thanks for this update Kiwi; however .msp is not on the list. Any suggestions?

Thanks,

Kate.

Re: How to block additional file types?

Raido_Rattameister — Fri, 11 Aug 2017 14:48:56 GMT

If it is binary file you might try hex editor to get binary signature from beginning of file and create your own vulnerability signature.

Re: How to block additional file types?

jvalentine — Mon, 14 Aug 2017 18:25:01 GMT

MSP files are currently detected under the Microsoft MSOFFICE file type, ID 52033 (at least that's how they're detected when passed through my firewall in my environment).

If blocking that causes you other issues, then I would recommend talking with your Palo Alto Networks SE to see if .MSP can be either combined with .MSI, or broken out on its own.

Re: How to block additional file types?

KateAdetola — Tue, 15 Aug 2017 08:51:36 GMT

Thanks @jvalentine; I will try this option and if it causes any problems I will speak to our PAN SE to see what is possible.

Thank you everyone for your responses!