topic Re: WhatsApp file types in General Topics

WhatsApp file types

househed — Fri, 31 Jan 2020 01:05:43 GMT

Hi,

Running R80.30, we currently have an application policy for WhatsApp file transfer, locked down to specific users, allowing all content.

When we first implemented and testing this, we noticed that allowing media files didnt seem to work. Assume because its encrypted.

Is there any way to lock it down to media files only?

Thank you.

Re: WhatsApp file types

PhoneBoy — Sat, 01 Feb 2020 00:45:42 GMT

WhatsApp is End to End encrypted and not something where you can see the precise content sent.
However, it's possible "WhatsApp Media" traffic looks different than for, say, text messages.
What do your firewall logs say when someone tries to upload/download media with your current rulebase?

Re: WhatsApp file types

Ilham_Syuhada — Mon, 14 Jun 2021 04:16:58 GMT

Hi @househed,

Have you found the solution right now ? I have same problem too, firewall log said only "whatsapp messanger" instead of "whatsapp messenger file transfer" on application name field.

Thank you.

Re: WhatsApp file types

househed — Tue, 15 Jun 2021 03:56:11 GMT

Hi @Ilham_Syuhada,

For the few users that need it, we've only allowed "WhatsApp Messenger-file transfer" and Any content.

Unfortunately, restricting the content type (Media and Images) did not work.

It must be because of the WhatsApp end-to-end encryption, the firewall cannot distinguish between the file types.

Hope that helps.

Re: WhatsApp file types

PhoneBoy — Tue, 15 Jun 2021 04:52:45 GMT

It may also depend on version/JHF level.
This would (likely) work better if you’re on a version that has SNI support.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk163594&partition=Basic&product=HTTPS