DLP not working with Dropbox Enhanced Uploader

Forum|Forum|9 years ago
March 4, 2017
3 replies
6510 views

Stats:

-Fortigate with 5.4.4 firmware

-DLP policy enabled, configured to block certain files

-SSL "full inspection" enabled. no category exemptions, no address exemptions for dropbox.com, reputable websites is disabled. Fortigate certificate installed on client machines, and appears in the browser when viewing dropbox.com.

-Proxy option Default policy enabled

When uploading a certain blocked file, DLP fails to block with Dropbox's "enhanced uploader." If I use the dropbox "basic uploader" the files is blocked with a DLP message from Fortigate.

Why could DLP be failing with the enhanced uploader?

JohnGeorgeAuthor

New Member

Further testing seems to indicate this is a problem specifically with "File Name Patterns" on the DLP policy. Why?

tanr

New Member

Is it possible the file is getting broken up and transferred through multiple connections (like google QUIC)? That might hide a filename and make other pattern matching difficult. I don't know if dropbox using HTTP/2 multiplexing for some things could be part of this.

Also, are you doing SSL deep inspection on all ports? Perhaps the enhanced uploader is just using non-standard ports? My understanding was that Dropbox only used HTTP and HTTPS, except for LAN sync, but that may no longer be the case.

Do let us know what you find. I've had to block QUIC and TEREDO on some subnets to allow full SSL inspection. Would be good to know if there is something else I need to work around as well.

hmtay_FTNT

Staff

Hello JohnGeorge,

I tested DLP + deep-inspection with Enhanced Uploader and I am able to block the files. From my traffic analysis, Dropbox does not appear to use QUIC protocol. I left "File Name Patterns" empty though. Looking at the plaintext HTTP headers, they look like standard headers that a regular string search should be able to easily detect.

Can you give me more information on the "File Name Patterns" you used and I can check on my side? Thanks!

HoMing

dropbox.jpg

Sign up

Login with SSO

Login to the community

Login with SSO