4

We would like to block the use of Flash on our internal network, but believe that several business-critical sites may still rely on that app. I'd love to be able to "watch" the traffic for several weeks to see which sites need Flash and then determine whether those sites are necessary in order for us to do business.

Do any of the security or web proxy vendors provide an ability to log those URLs that attempt to access or call Flash content? Or could the firewall provide this intel? Other ideas?

Improve this question
3
  • 8
    Easiest way is to just kill it and see who screams. Of course, that may not go over so well.
    – Iszi
    Commented Nov 2, 2015 at 17:43
  • @Iszi frankly, that is what I've done in organizations... I couldn't find another way.
    – schroeder ♦
    Commented Nov 2, 2015 at 17:46
  • +1 for @Iszi 's suggestion. When setting up any firewall or form of security you should favor the most restrictive option. And then open what you need open. You will find what your employees feel like they "need" are most likely wants. Have them come to you and make their argument. And decide if it merits access. Be prepared to put a foot down too. At least have a higher up sign off on something risky if your hands are tied. After all, when something is compromised it isn't their job on the line. It's the guy who had the job of preventing it.
    – Bacon Brad
    Commented Nov 2, 2015 at 22:58

1 Answer 1

Reset to default
5

In most cases flash content is served with a distinct content-type like application/x-shockwave-flash. Proxies like squid can log this content-type additionally to the URL and I'm sure lots of the better firewalls can log this too. Note that simple packet filtering firewalls (iptables etc) will not be able to do this.

Since I doubt that you will replace your existing firewall with another solution or that you will add a proxy to the network and reconfigure all clients just for this feature I would recommend you contact the support of the solution you currently have and ask them. Also, since lots of content today is delivered by HTTPS you must either ignore this traffic or intercept it if your currently used product supports it.

Apart from that you might also used tools like tcpdump/tshark or IDS like bro to passively sniff the traffic and extract the HTTP traffic matching the specific content-type. This will not for for HTTPS though.

Improve this answer
4
  • 1
    squid in transparent proxy mode is one of the perfect tool to achieve this malware filtering on content-type.
    – athena
    Commented Nov 2, 2015 at 19:27
  • @danielAzuelos: I would not suggest to filter malware based on the content-type only. There is no "application/x-malware". It is no problem do transport malware as image/gif or similar. But all of this is not an issue of squid itself which is a robust proxy.
    – Steffen Ullrich
    Commented Nov 2, 2015 at 19:52
  • 1
    Right. I should have typed malware here. For me Flash is a malware, not as its main purpose, but as a consequence of a lack of action from Adobe to build a safe product.
    – athena
    Commented Nov 2, 2015 at 20:01
  • 2
    @danielAzuelos: even in this case I'm sure that is is possible to deliver flash with a different content-type. Just because the good guys use the conventional content-type does not mean that the bad guys must too, see security.stackexchange.com/questions/42904/…. To really block SWF you would probably need to look at the actual content.
    – Steffen Ullrich
    Commented Nov 2, 2015 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .