DLP Endpoint Agent 15.8 does not immediately block WeTransfer file uploads in Chrome

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

With DLP 15.7, it was possible to block file uploads to WeTransfer - the upload block was seen immediately after a file has been uploaded to the website via the "Upload files" blue plus sign. 

In DLP 15.8, this is still the behavior with Firefox but not with Chrome. 

Resolution

Due to a redesign of the DLP Chrome browser extension between DLP 15.7 and 15.8, this has also changed how Wetransfer file uploads done in Chrome are processed and detected by DLP.

In DLP 15.8, the following is the expected process of file upload detection with WeTransfer:

1) With DLP 15.8 Agent running, open Chrome and go to wetransfer.com.
2) Click on the blue plus sign next to "Upload files" and select a file with sensitive content which should trigger an Agent block popup during upload attempt. 
3) At this point, when Chrome is used, the 15.8 Agent does not show the block popup just yet. With Firefox and with Chrome on a 15.7 Agent, the popup would be already shown at this stage. 
4) Fill in the fields "Email to" and "Your email". 
5) The "Transfer" button becomes active, click it now. Wetransfer then asks to enter a verification code which should come in via e-mail.
6) After entering the code and clicking "Verify", Wetransfer attempts to start the file upload. It is now that the DLP Agent displays the block popup. The "Transferring" prompt gets stuck at 0%, indicating a blocked file upload. 
7) Wetransfer also offers another option to upload and share files - via a link. Refresh Wetransfer, select the same violating file again and then click on the "three dots" button to the left of "Transfer".
8) Two options are available - "Send email transfer" and "Get transfer link". Select the second one and click on "Get a link".
9) Same situation happens - the DLP block popup is shown and the transfer is stuck at 0%.
One thing to note is that if you did not refresh Wetransfer in point 7, but instead tried to just generate the transfer link with the same file with which you've tried to send it via e-mail, you may not get a DLP popup as DLP will treat this as still the same file upload request. However, the transfer will also be stuck at 0%. 

There is a difference as to when the popup is displayed between 15.8+Chrome (after entering the verification code or generating a transfer link), and 15.8+Firefox/15.7+Chrome (immediately when a file is uploaded). But otherwise, the file upload detection and blocking itself still works in DLP 15.8 with Chrome - what changes is at which stage of the upload is the block seen.