topic Re: Block a particular Google Document in General Topics

Block a particular Google Document

dmarion — Mon, 30 Apr 2012 18:21:48 GMT

Greetings,

One of my users forwarded me a phishing email that points to Google Docs to collect information (username/password). The URL looks like: "https://docs.google.com/a/b/c/viewform?formkey=asdfasdfasdfasdf" (not the real url). Is there a way to block one google doc in PANOS?

Thanks,

Dave M

Re: Block a particular Google Document

mikand — Mon, 30 Apr 2012 18:50:33 GMT

You should be able to create your custom threat signature to detect this and block (and log) when this particular link is being clicked on.

The tricky part might be how to create the signature so it will limit number of false positives but at the same time not miss any of the many domainnames which google can use for the access. Meaning is it enough if you do something like:

base application: google-docs

host: *.google.*

AND

uri: /a/b/c/viewform?formkey=asdfasdfasdfasdf

I think you might need ssl decryption aswell since this is https.

Re: Block a particular Google Document

jhickey — Tue, 08 May 2012 00:26:55 GMT

Im having the same problem in a big way. I thought URL Filtering was suppose to be able to block websites through SSL even without decryption. I understand the custom block page not being allowed but I thought enough of the header was readable to throw up at least an ugly ACCESS Denied page.

Google Docs is sending us fresh SSL based phishing schemes like almost every day. Not good !!

Re: Block a particular Google Document

mikand — Tue, 08 May 2012 06:41:03 GMT

You must have ssl decryption running in order to be able to see which URL is being requested within the SSL/TLS session.

But I dont know if the url-filter in PA also includes ip addresses since you must specify url-categories when you setup the ssl decryption rules.