Using Save As in Adobe Reader and Acrobat Pro to save pdf files to removable storage and network, the DLP Agent does not appear to block the file

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Suite

Issue/Introduction

When using the "Save As" option to save a copy of a pdf file to a removable storage device or a network share, the DLP Endpoint Agent will display the block popup and an incident will be generated saying the file was blocked, however the file does not appear to be blocked. A pdf file with the same name still gets written to the destination location. The file that is copied to a network share is 0 KB in size whereas the file copied to the removable storage appears to be the original file size but is corrupted and cannot be opened.

Environment

Adobe Reader or Adobe Acrobat Pro with DLP Windows Endpoint Agent

Cause

Adobe is creating the stub file AFTER the DLP Endpoint Agent has already blocked the original file transfer. No sensitive data is stored in the stub file. This behavior has only been observed in Adobe Reader and Adobe Acrobat Pro. Other applications tested including other PDF readers like FoxIt PDF reader do not show this behavior.

Resolution

As the stub file is either empty or has corrupted data and cannot be opened, no risk of data loss occurs. The stub file can be deleted after closing the Adobe application.