Endpoint Protection

How to Block Skype application thru SEP using Firewall Policy ?


Regards...
Ramji Iyyer

 In the firewall add rule - instead of host or service select Application.
Just put the process name ( skype.exe ) nothing else.
Next ..next..finish
Change the action to block from allow.
Apply the rule to all the groups.

Update policy on the client.
Restart the skype application and it will not be able to connect ..

Thanks Vikram !!!

I will Check & confirm !!!


Regards....
Ramji Iyyer

Mr Vikram is Rigth. This is very fast and easy way to block.
And you can block it via filefingerprint too.

Thanks
Fatih

How to add a rule using the"Add Firewall Rule Wizard"

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008060208101648

If I block by rocess name ( skype.exe ) then a smart user can rename the executable and still use it.
If I block by fingerprint then the user cannot get around it but we need then have the fingerprints for all versions of Skype.

Hope this table below does not get messed when posting.

Name	Version	File Fingerprint
TosSkypeApl.exe	1.0.0.5	F026ABB6D884ADFD6493DEA04FC38EE0
SkypeNames.exe	1.0.1.9	AE82B3B6A33DC23019B604DA5920D726
skypePM.exe	1.2.0.261	AA1259B20E59CAEAB07C54BF3DBDE8DD
skypePM.exe	1.5.0.3	942A6D257DBDA957C4B19169B3BBBC7D
skypePM.exe	1.5.0.32	8A4177883F756B18B50366B3B1878E5F
Skype.exe	2.0.0.105	9BB317F9AAD3AEFBA0C5C70B03C354FF
Skype.exe	2.0.0.107	A30CF423AE0C6DBCD97C34EFA3A88C29
skypePM.exe	2.0.0.58	A8D36ADDD1FCD24A450807EE693E4762
skypePM.exe	2.0.0.60	177A63C7C2C25CC5BC36D93EBFD13D5A
skypePM.exe	2.0.0.65	A3996F435192AAEE6CB5D7E45E3A51FF
skypePM.exe	2.0.0.67	89CF33E9040E3CC39F097238D3D97032
Skype.exe	2.0.0.76	F6D939ED19C8DE8410B904D7A234DDB3
Skype.exe	2.0.0.79	3A21F7E56E8AF90C762ABAB6085FA2D0
Skype.exe	2.0.0.97	BB6D574B1913E9E1C1D1BC1E69DAE29B
Skype.exe	2.5.0.122	964408A427F7475170472DA677A9D912
Skype.exe	2.5.0.126	4FD26740E9FF5C24D2BDF1EFC1425D23
Skype.exe	2.5.0.141	9A9CF053CC6F3445C327F2DE28F59F81
Skype.exe	2.5.0.72	8200F36AFA540C56FB6E81128D52BE74
Skype.exe	3.0.0.198	8909FDEE5DA6499CAEFC607DA5065AE1
Skype.exe	3.1.0.152	F6AC391E2CAE1794111F3D0AE2FA6234
Skype.exe	3.2.0.158	7004B873BBFA0B29AABC637F3D2522C6
Skype.exe	3.2.0.163	8E69E5858BB7FDF95D2554CF95323E9C
Skype.exe	3.5.0.229	5462433623FE02C774C8B9A3C4707432
Skype.exe	3.5.0.239	72F095A18223E1072F242EA25D1C6E8E
Skype.exe	3.6.0.216	117268C20028D5EE9359DA6E8D74DF07
Skype.exe	3.6.0.244	8D7A6AB6665530A90C00FABD30136D4A
Skype.exe	3.6.0.248	EDBC8611E999C96F881B8AA10AE7FD75
Skype.exe	3.8.0.154	156066A779731A06DF364E439119B055
Skype.exe	3.8.0.180	4BD55DF6374E27416F21CF06CBB2D991
Skype.exe	3.8.0.188	53393FE192776D53640C447CA18B3E22
Skype.exe	4.0.0.150	46B5A462EF596945DB494C30C85E65FE
Skype.exe	4.0.0.206	9B3FBBA3323ABC790961F2A1475618BD
Skype.exe	4.0.0.226	E52F62AA37AA8B9D9E5DEF5C587C68B1
Skype.exe	4.0.0.227	E993248B104476D718FA87AB93A39E2A
Skype.exe	4.1.0.166	9780A4EC41060F6164CC5DDDC815DB34
Skype.exe	4.1.0.179	BF9EAB227D409CE1E75C23BB10CF5DBC

:) you should block all. because you cannot know which of them used by users. for example when skype create new version fingerprint will change. therefore you should to follow learned application notification. you can search exe names and can find new file fingerprint.

Regards
Fatih

Hi -

Does anyone have the MD5s for the most recent releases of Skype?  

Doug

What about just blocking skype network communication with IPS?

thatdue, I'm looking at the Intrusion Prevention policy right now...  Where in there would you block skype network communication?  I see only the ability to exclude hosts.