[7.911][BUG][FIXED] Possible bad IPS rule

I just happened to take a look at the IPS report for today on my V8 beta test box and saw something interesting.

Rule ID:  16460
Rule Description:  WEB-MISC text/html content-type without HTML - possible malware C&C
Rule Group:  Server / HTTP / Common
Packets:  412

The source IP's of these attacks are 64.191.223.35 and 64.191.223.36, which just so happen to be addresses for Commtouch. Due to this, I'm not sure if the AntiSpam reputation information is getting updated or not. Just thought I'd let somebody know.

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report

--------------------------------

Version: 7.911

Type: BUG

State: RESOLVED/FIXED

Reporter: Scott_Klassen+

Contributor: BrucekConvergent, Billybob

MantisID: 13719

Target version: 

Fixed in version: 

--------------------------------

0 kbr over 15 years ago

Thanks for reporting this. We've put this on our internal watchlist, but haven't seen any issues related to this id. If this is a false positive and becomes a problem, we'll be able to react quickly, but until then i can't assign it a mantis id.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to kbr

kbr, I started a case some time ago under 7.504 ... all of my managed customers were having false positives with this rule. Astaro Support said it was part of the HTTP Server rule group, and should only be a problem if one has it enabled but has no servers defined under the tuning section. That was not the case; but I dropped the issue with them (I just didn't have time to send them more log data) and ended up disabling that rule on all of my managed customers. I definitely believe that it's a bad rule.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago

Okay, convinced. I added this one to mantis. But to solve this problem we need more log data.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to kbr

I'll find my case ID and pass it on... I did send in log data with that case.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 15 years ago in reply to kbr

Thanks for reporting this. We've put this on our internal watchlist, but haven't seen any issues related to this id. If this is a false positive and becomes a problem, we'll be able to react quickly, but until then i can't assign it a mantis id.

I thought you already had a mantis ID on this [:P] https://community.sophos.com/products/unified-threat-management/astaroorg/f/102/t/69515
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Scott_Klassen over 15 years ago

I'll poke back in my logs a couple of days and get it to you kbr.

BTW, I thought today was a holiday in Germany and Astaro employees had the day off. kbr: slowly back away from the computer and go have fun for a day. [:)]

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago in reply to Scott_Klassen

kbr: slowly back away from the computer and go have fun for a day. [:)]

Fun is exactly the right term, because i'm currently reading Helle Barden (the english original is called Men at Arms), a novel by my favorite authorTerry Pratchett.
And yes, it's a real book (you know, the thing made out of dead trees). ;-)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 15 years ago in reply to kbr

KBR, here's the case info (I was having problems with this rule back on April 15th; all of my customers were affected):

[Ticket#2010041510000427] CaseID 00120444

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Sascha Paris over 15 years ago in reply to BrucekConvergent

This rule also will be triggered by dropbox (File synchronization / sharing tool)
==> Dropbox - Home - Online backup, file sync and sharing made easy.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel