Files that are uploaded to https://smallpdf.com site do not get blocked by DLP Endpoint Agent

Products

• Data Loss Prevention

Issue/Introduction

DLP Endpoint Agent does not detect the files that are uploaded to the site https://smallpdf.com which are converted from Microsoft Office file types to PDF.

Cause

This site "https://smallpdf.com” converts the data into a random string. It’s impossible to detect the file name, the content, or file type due to the technology used by this site.

Resolution

It's advisable to block this site if possible and recommend your users to use a licensed offline PDF converter if required.

Alternatively create a policy with the keyword rule to match keyword = smallpdf and protocol = HTTP, HTTPS/SSL with an Endpoint Response Rule to Block. 

This method may work for some upload attempts if the smallpdf is present in the header.