Blocking images with EXIF data

Reply
L0 Member

Blocking images with EXIF data

I have a customer that wants to block outbound images that have EXIF data (gps coordinates).  Can this be accomplished with a customer app-id doing a pattern match perhaps?

L4 Transporter

Re: Blocking images with EXIF data

Hello chrisdduncan,

Yes if the customer can create a custom application after analyzing the data pattern and loading that as a signature in the custom app and block it as needed.

I have seen in file blocking profile that I do not find a file type exif. But if this can be caught as a signature then yes we can have control over it.

Thanks

L6 Presenter

Re: Blocking images with EXIF data

Please send me a PM (or even better put it online in this thread :-) in case somebody has already created such IDS signature for PA. That is images containing EXIF data (or more specific containing geolocation EXIF data).

Highlighted
L5 Sessionator

Re: Blocking images with EXIF data

Hi,

I would suggest to post the question in dev center community.

It is"the online community for customers, partners, and employees to share custom content including Custom App-IDs, Custom Threats, Custom Reports, XML API integration, CLI scripts, and other tools. Use the discussion threads to ask questions and receive help from other members. The current samples would be a good start. "

There might be someone already who has worked on this app. Also you can submit a request for new app. The following link explains on how you can do that

https://live.paloaltonetworks.com/docs/DOC-1879

Hope this helps.

Regards,

Numan

L5 Sessionator

Re: Blocking images with EXIF data

I guess it's not possible to do pattern match because what you'll do here is to look for EXIF tag IDs for GPS but they are less than 7 bytes.

0x8825 : GPSInfoIFDPointer

0xF4240 : GPSVersionID

etc

- Yasu

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!