Problems with blocking urls with .js or .css

[simonorch]

Have others here had issues with blocking urls\downloads that inlcude .js or .css files? fortiguard correctly catagorises the website and the main site, images etc. are blocked but it seems that if directly accessing a url with the above extensions, webfiltering is bypassed?

[Gjermund]

Tested on version 5.0 Patch 5 By doing the following you can safely test this Fortigate security hole: 1) Under " Security Profile -> Web Filter -> Profiles" , check/enable FortiGuard Categories and block " Adult/Mature Content -> Pornography" . 2) Remember to check the box before " Rate Images by URL (Blocked images will be replaced with blanks)" so that images will be blocked. If this box is not checked you are able to download images from any domains in a blocked category. You can test this if you enable/use this WEB-filter profile in your Policy and try to visiting http://static2.playboy.com/assets/tour/img/home/casting-call-small-dallas.jpg (a safe picture of the American city Dallas). 3) Visit http://static2.playboy.com/. This site is correctly blocked as Pornography. 4) Visit http://static2.playboy.com/assets/tour/css/common.css?cb=134 and download the content. This CSS-file is not blocked. 5) Visit http://static2.playboy.com/assets/tour/js/base/firstload.js?cb=134 and download the content. This JS-file is not blocked. In this test you are downloading a .css-file and a .js-file from a blocked domain. But the file could be a .zip, .exe, .bat, or anything else as long as it is not a picture or .html/.shtml/.htm-file. I would argue that this is a big security problem. If you block the Fortigate Category " Security Risk" your clients should be safe from malware from these domains right? Well, they are still able to get infected since malware does not come as HTML-files or pictures. This means that your clients can visit http://www.orgsite.info/.../cryptolocker.exe or http://www.gumblar.cn/.../flashback.payload or http://www.d99q.cn/../sasser.js and download and run the content and get infected with whatever malware the site host at the time. An infected client can also download updates for the malware it has. You can argue that this will be stopped by the Fortigate Antivirus or IPS. That would be true if the Fortigate had all of todays and future signatures. Since malware mutate fast, new ones rise every minute and they are often encrypted it would be impossible for the Fortigate to recognize and stop every type of malware from entering your network. Can you fix this Fortinet? If I decide to block domains using the " Fortigate Category" , I would like the Web Filter to block ANY web-request to those blocked domains. This is how Sophos UTM and CheckPoint (I have tested them) and probably all the other FW-vendors do it.

[netmin]

For js and css files it is documented on page 88 here: http://docs.fortinet.com/fgt/handbook/50/5-0-5/fortigate-security_profiles-50.pdf " The reason for this is that to optimize speed throughput and reduce the load on the FortiGuard servers the FortiGate does not determine a category rating on scripts and css files." But rating by domain and ip + ftgd-wf strict-blocking could help here.

[Gjermund]

Allowing clients to download/run CSS and JS file from any domain is a security risk. Hiding malware in JavaScript is easy, and it is highly unlikely that the Fortigate antivirus will be able to stop all of it from running and installing on a client/server. The whole point of using a web-filter is to completely block access to domains that the company do not want client/servers to access. I find it questionable that Fortinet has decided to allow certain files (and thereby compromising the security) to make the Fortigate look better when comparing web filtering speed against other vendors. Is it possible to make the Fortigate block the domains selected from " Security Profile – Web Filter – Profiles - FortiGuard Categories" completely? Is there a switch in CLI or GUI that makes it block any request to these domains so that JS and CSS files will be blocked as well?