I am interested in how DLP systems work. I have noticed that developers of DLP say that the software can see messenger traffic including end-to-end solutions. I understand MITM, certificate change, but in the case of end-to-end, how does it work? There is encryption between two devices, the third device cannot see it, isn't that correct? It must decrypt for analyzing traffic.

  • Hi and welcome. I removed the second question because it is unrelated to the first and is completely dependent on the software you use. For example, I have used DLP solutions that do not take screenshots (that does not sound like DLP to me, actually).
    – schroeder
    Aug 5, 2019 at 8:56
  • Can you link to something saying that a DLP package can see end-to-end encrypted messages?
    – schroeder
    Aug 5, 2019 at 8:56
  • They can probably see the traffic, but can't interpret it. I have seen DLP solutions look for weird spikes based on ML and than flag that as a possible data exfiltration, but obviously they have no way of seeing what kind of data was exfiltrated. Aug 5, 2019 at 15:40
  • @schroeder, hi. I will try to find related articles, but they in russian. About screenshots - i think the biggest part do that, foe example, i detected it in wireshark, remote server sends me command SCREENSHOT, my pc send answer with encrypted data. Admin has confirmed that dlp make screenshots. For example, you can search searchinfrom dlp solution Aug 5, 2019 at 17:24
  • @RaimondsLiepiņš, sound reasonable, but for example, well known that skype is fully watched by dlp systems, in last time i read similar info about telegram and viber desktop. Aug 5, 2019 at 17:25

1 Answer 1


It will depend on the specific implementation of the specific product and the specific message traffic.

Data Loss Prevention tools tend to work in one of two ways: they sit on the network and look at logs, read emails, read file shares; or they are installed as a desktop agent which, the vendors assert, has full access to every keystroke, window, file and memory object. DLP vendors, IMHO, like to assert much. The network DLP products may require that the end user organisation tags data of interest. The product then uses its magic unicorn to identify all those documents with that tag. The agent-based products will know what files are being touched and can therefore assign a risk weighting to actions and hence report on them via the dashboards that they seem to love.

To read a message then could be as simple as the keystrokes being captured, could be the window being asked to report on its contents, it could be that the tool has the message certs and it implements a MITM as you say. It could be as simple as reading the message store from the message server.

Regulated institutions such as financial service trading floors may have a requirement to monitor and record all instant messages being used. Many years ago I implemented IMLogic which was an IM compliance tool used by an investment bank as their traders used all the IM clients to have personal calls with external parties. They had a client that intercepted messages and sent them to the server for storage: nothing particularly clever.

The DLP products can only report on what they know: I expect that it would be possible to write your own chat client that they could not inspect if you had full end-to-end encryption.

The only way to be absolutely sure about how a specific vendor monitors a specific chat channel is to ask them.

  • Unfortunately, vendors do not demonstrate their tech details( but thanks, sounds reasonable. Aug 7, 2019 at 15:59
  • @askkeratone I get called by vendors constantly who want to do a demo. If you can persuade them that you work for a company that might buy their prioduct then they may give you a webex with a sales engineer. The sales engineer will explain how the tool works. Failing that, go to Infosec and ask them there, if you can bear the sales pitch that will come with it. Aug 7, 2019 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .