Question Attached PDF file(written in Japanese) is damaged after uploaded via VPN. How can I avoid this failure?

[kimuchundo]

Currently we are working with an IBM workflow application called FormWave and
running an electronic approval system and working at home using VPN((wifi at home).
We are struggling with the investigation because there is a problem that the file is damaged when uploaded via VPN.
Corruption means that when viewed with a binary editor, some data becomes zero bytes.

-Environment and Conditions
・App: IBM FormWave for WebSphere 6.1.2.3
・Middle: IBM WebSphere Application Server 7.0.0.13
・DB: IBM DB2 9.7.3
・OS: IBM AIX 6.1 TL7 SP6
・VPN: 2 channels(VPN1, VPN2) via wifi at home

*Not occur
・Internal network(company)
・Tethering(via VPN) from iPhone which is provided by company

-Steps
① Convert to PDF file written in Japanese on PC
② Save the PDF file as an attached file to the electronic approval that is connected by vpn
③ Download the file saved in electronic approval on your PC

-Problems
When opening the file attached to the electronic approval via VPN(wifi), the following events occur.
・Color unevenness of image data (ex. the background becomes greenish)
・Characters are faint
・Font cannot be read and characters are not displayed.
・Error displayed when opening a file
・occurs only at PDF files and other files like Excel, word are displayed correctly.
・different results between VPN1 and VPN2 and VPN1 occur less events.

We investgated VPN differeces between VPN1 and VPN2 because there are different results from both VPNs.
We found large sized files may occur events more frequently than small sized files.
There is regularity in the place where the replacement by zero occurs.
Although it is different from the replacement part, it has the common point that the size of the replaced data is
always 5 bytes. There are cases where replacement occurs with less than 5 bytes
but it occurs when the data before replacement was originally zero.
What could be the cause?

Any help would be appreciated.

-The first image is binary data comparison.
left is original and right is uploaded file. blue parts are turned to red parts(00 byte)

 

[SamirD]

Obviously there is some sort of data corruption happening on the vpn connections. Have you tried different ciphers for the vpn connections? I would also simply try transferring a zip file and testing it. If a zip is corrupted, than anything will be corrupted and the corruption source needs to be fixed.

 

[mxnerd]

Agree with @SamirD , zip / 7zip the file see if it resolves the issue.

==

I personally think IBM's App is more likely the culprit, not your VPN links.

==

What VPN links and VPN clients were used?

 

[kimuchundo]

Obviously there is some sort of data corruption happening on the vpn connections. Have you tried different ciphers for the vpn connections? I would also simply try transferring a zip file and testing it. If a zip is corrupted, than anything will be corrupted and the corruption source needs to be fixed.

Thank you for the reply. I will try transferring a zip file.

 

[kimuchundo]

Agree with @SamirD , zip / 7zip the file see if it resolves the issue.

==

I personally think IBM's App is more likely the culprit, not your VPN links.

==

What VPN links and VPN clients were used?

Thanks for the reply. VPN client is BIG-IP Edge Client.
I don't get VPN links. Could you explain and where to know VPN links?

 

[SamirD]

I don't get VPN links. Could you explain and where to know VPN links?

How are the vpn links implemented? In routers? In PCs? What method--Ipsec/openvpn/etc?

 

[mxnerd]

VPN link just means the link or tunnel from your device to the server.

OK. So the Big IP VPN Client is from F5.com (A Seattle company)

Regional Offices

Find contact information for our offices around the globe.

www.f5.com

Seems a SSL VPN.

Open the logviewer see if there is any error during transmission.

Ask your company IT dept to contact F5 for help if needed.

 

[mxnerd]

And OP mentioned electronic approval, what is it?

 

[JackMDS]

Zip the file and encrypt it with strong Password.

Then use a regular Internet (No VPN).

That will allow to rule In, or Out the VPN service.

That said, translating Symbolic language to Alpha is always less accurate than Alpha to Alpha.

 

[kimuchundo]

And OP mentioned electronic approval, what is it?

it is an electronic authorization system or electronic settlement system.

 

[kimuchundo]

VPN link just means the link or tunnel from your device to the server.

OK. So the Big IP VPN Client is from F5.com (A Seattle company)

Regional Offices

Find contact information for our offices around the globe.

www.f5.com

Seems a SSL VPN.

Open the logviewer see if there is any error during transmission.

Ask your company IT dept to contact F5 for help if needed.

thanks. I will check.

 

[kimuchundo]

Zip the file and encrypt it with strong Password.

Then use a regular Internet (No VPN).

That will allow to rule In, or Out the VPN service.

That said, translating Symbolic language to Alpha is always less accurate than Alpha to Alpha.

I don't understand "Then use a regular Internet (No VPN) ~."
I cannot connect to the internet without VPN. It is blocked to connect to the internet.

 

[mxnerd]

it is an electronic authorization system or electronic settlement system.

What's the name? I was wondering whether it's the system corrupted the uploaded files.

And whether there is any possibility that any sort of security software that sabotaged the files.

I cannot connect to the internet without VPN. It is blocked to connect to the internet.

Apparently your company does not allow non VPN connection and you will not have any way to test.

 

[kimuchundo]

What's the name? I was wondering whether it's the system corrupted the uploaded files.

And whether there is any possibility that any sort of security software that sabotaged the files.

Apparently your company does not allow non VPN connection and you will not have any way to test.

The system is "IBM FormWave for WebSphere " as I mentioned in the question.
We haven't found any security software corrupting files so far.

 

[mxnerd]

I would say it's either F5's or IBM's problem. (More likely F5, caused by data caching or compression, cleaning, virus removing, etc.) The corrupted files apparently were sabotaged.

BIG IP Edge Gateway Architecture

https://www.zerone.com.tw/support/F5/2-F5.EGW1600-i.pdf

Strong endpoint security
BIG-IP Edge Gateway provides a broad layer of endpoint inspection to validate client security postures against corporate policy. Endpoint inspection protects against worms, viruses, and accidental data loss. More than a dozen integrated endpoint inspection checks are preconfigured, including Windows, Macintosh, Linux, antivirus, and firewall checks. Other checking features include: file, process, OS, and registry checks; assignment of dynamic access control lists (ACLs) based on endpoint posture to deliver context-based security; and browser cache cleaning to remove any sensitive data at the end of a user’s session.

https://www.f5.com/pdf/deployment-guides/f5-ibm-websphere7-dg.pdf

=

zipping the files with a password probably can be a temporary solution before a real solution comes out.

==

Or maybe it can be easily solved by changing rules on BIG IP Edge Gateway.

==

Anyway, call your IT Dept / vendors.

 

[kimuchundo]

I would say it's either F5's or IBM's problem. (More likely F5, caused by data caching or compression, cleaning, virus removing, etc.) The corrupted files apparently were sabotaged.

BIG IP Edge Gateway Architecture

https://www.zerone.com.tw/support/F5/2-F5.EGW1600-i.pdf

Strong endpoint security
BIG-IP Edge Gateway provides a broad layer of endpoint inspection to validate client security postures against corporate policy. Endpoint inspection protects against worms, viruses, and accidental data loss. More than a dozen integrated endpoint inspection checks are preconfigured, including Windows, Macintosh, Linux, antivirus, and firewall checks. Other checking features include: file, process, OS, and registry checks; assignment of dynamic access control lists (ACLs) based on endpoint posture to deliver context-based security; and browser cache cleaning to remove any sensitive data at the end of a user’s session.

https://www.f5.com/pdf/deployment-guides/f5-ibm-websphere7-dg.pdf

=

zipping the files with a password probably can be a temporary solution before a real solution comes out.

==

Or maybe it can be easily solved by changing rules on BIG IP Edge Gateway.

==

Anyway, call your IT Dept / vendors.

Thank you for the reply.
We tested transferring encrypted zip files(7zip) but still occur corruption(a little less occur than the original PDFs).
And I could find any error log related during transmission.
Let me check F5 as you suggested.