Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 13 replies
  • Subscribers 41 subscribers
  • Views 8250 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocking Tiktok via Firewall Application Control and Endpoint Application and Web policies

DavidSain

Defense contractors and others with government contracts are now required to block access to TikTok.  We have a number of customers that fit into this category.

Sophos has long had Musical.ly as an available application to block in SF, even in the last couple of days. As of today, now it can be found in the application Filter as TikTok instead of Musical.ly. Same thing, different name.  Not sure why it was called Musical.ly in the first place. but now it's much more clear.

My employer sent me a firewall for my home-office as I'm remote. since I'm trying to resolve this for our customers, I'm applying it to myself. I created a new Application filter named Block level 5 and TikTok.  I added TikTok Deny Always..



Here I have the Application Control applied to my LAN to WAN rule.

And Here is TikTok running on Windows just fine.



Sophos endpoint will block the website easily enough. I've actually added all the IP addresses, subnets, and FQDNs from the Netify page and from SonicWall's document for blocking TikTok.  Here you can see a Web policy (which works) and a Application control policy for BlueStacks.  There is no application control for TikTok or Windows Subsystem for Android.

It still runs. Packet Capture shows traffic to an IP that resolves as an Akamai server.  Akamai serves a lot of streaming media so we can't just block them.

TikTok is like some crazy virus that works around every effort to block it.  

Support on ticket 06916584  wants me to submit the executables to Sophos, but not understanding the Microsoft Store doesn't do exe files like the olden days of Windows.  Now they are packaged in a different way now and are placed in a folder inaccessible, even to local admin.  Unless one wishes to take ownership from Trusted Installer and see what happens for C:\Program Files\WindowsApps\.
https://answers.microsoft.com/en-us/windows/forum/all/microsoft-store-downloads-folder/cc682ce8-6e1e-404e-a27e-a543e3afac7f

BlueStacks is another Android emulator and that's why the Application control policy for it.  Does nothing to stop BlueStacks 5 and BlueStacks X from loading but looks pretty in Central.

How do we stop this scourge?

Thanks!

David

Sophos Firewall Architect 18-19.5
Sophos Firewall Engineer 16.0-19.5
Sophos Firewall Technician 18-19.5
Sophos Central and Endpoint Engineer 3.0-4.0
Sophos Central and Endpoint Architect 3.0-4.0
Among others...



This thread was automatically locked due to age.
Parents
  • 0

    As a recap,

    I have TikTok blocked on the network with firewall, 2 different ways:

    Application Control, TikTok is now available and works to block TikTok running on Windows or Android in the app. I assume it will block iOS as well.

    Web Control, Blocking the entire list from Netify and SonicWall, TikTok can no longer load in a browser, including ads.

    I have TikTok blocked in Windows (for mobile users not behind the firewall) with Endpoint using 

    Web Control - to block the same list of IPs/Subnets/FQDNs from Netify and SonicWall when using a browser.

    Application Control - to Block Windows Subsystem for Android (WSA) when using the App. This blocks anything running on WSA.

    To-Do

    1) Figure out how to get iOS/Android devices running TikTok marked as non-compliant in Intune. Although my device is Android and registered, I cannot apply any policies to it. This is outside of the scope of working with Sophos.  Approaching this using Android Device Administrator (which is now deprecated) allows me to select applications to block.  Using Android Enterprise, there is no option to select applications to block <facepalm>.  So it looks like we might have to use Sophos MDM. And build all of this out in a third place.

    2) Get Sophos to block BlueStacks X (have an open case for this).

    Sophos Firewall Engineer 16.0, 16.5, 17.0, 17.1, 17.5, 18.0, 18.5, 19.0, 19.5, 20.0
    Sophos Firewall Architect 18.0, 18.5, 19.0, 19.5, 20.0
    Sophos Firewall Technician 18.0, 18.5, 19.0, 19.5, 20.0
    Sophos Central & Endpoint Architect 3.0, 4.0
    Sophos Central Email v2.0
    Sophos Mobile v9.6
    Sophos ZTNA 1.0, 2.0
    Synchronized Security Accredited
    Sophos Gold Partner

  • 0 in reply to DavidSain

    Hello David,

    Thank you for confirming about TikTok. For Bluestacks, our team is already working on it. We suspect that the existing version of Bluestack, which is currently available under the App control data base isn’t up to date, which is causing the Bluestacks to still run even after adding the app to block list. Our engineer will keep you posted via the support case you've raised for the update. 

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to GlennSen

    Hi Glenn,

    basically what Sophos is advising in reality is I need end point installed on my home devices? Not sure if that is practical or even available for home users?

    Ian

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • 0 in reply to GlennSen

    Hi Glenn,

    basically what Sophos is advising in reality is I need end point installed on my home devices? Not sure if that is practical or even available for home users?

    Ian

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Children
No Data
Unfiltered HTML