Can a firewall recognize (and block) outbound traffic that consists of screen shots?

Question

I recently watched this YouTube video about capturing webcam image traffic using Wireshark. Although the technique used in the video is not applicable to my question (because it is about a MITM situation), it shows how image data, such as from webcams, is sent across a network.

What I am mainly interested in is blocking screen shots taken by malware and similar code.

Question: Is it feasible to have a hardware firewall device to keep an eye on packet data and remove packets that contain images, or is this sort of low-level analysis typically too taxing for a consumer-grade devices?

Answer 1

Deep packet analysis or similar would be able to detect the transfer of images in general if the attacker does it in a stupid way, i.e. just as a HTTP post or similar and without any attempt to hide it (even a simple XOR with a fixed value or swapping of bytes or similar would likely be enough to be hidden). But even then it would be hard to impossible to distinguish a screen shot send by malware from an image send by the user, especially since the user might post screen shots too. Apart from that consumer.grade devices usually don't do the necessary deeper payload analysis but look mainly at IP and port.

In other words: I doubt that any firewall does this and if it claims to do this an attacker could likely easily bypass this. It is probably more useful to look at other properties of the communication instead, like unusual user agents, unusual behavior (i.e. does not look like normal browsing), suspicious communication targets etc. None of this provides reliably detection without false positives but it can point some analyst to the suspicious things to take a closer look.