[8.940][OPEN] UTM unable to catch virus (sophos endpoint does)

Hi All

I have HTTp proxy with both antivirus enabled. Also I have sophos endpoint installed.

It seems that the endpoint catch more virus that the UTM. I would expect the sophos engine to get the following since (that's my understanding) both sophos engines are the same (UTM and endpoint)

Log below from the endpoint alert

Event: Access has been blocked to **********/gipoto/dabstepinattack.php" as 'Mal/ExpJS-AA' has been found at this website.

Relevant log from web filter

2012:05:05-10:41:07 ****httpproxy[4521]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.***.***" dstip="173.236.50.237" user="" statuscode="200" cached="4" profile="REF_CnNPwVRtng (Internal Users)" filteraction="REF_DefaultHTTPCFFBlockAction (Internal Users)" size="11580" request="0xa96de5e0" url="http://********/gipoto/dabstepinattack.php" exceptions="" error="" country="United States" category="178" reputation="neutral" categoryname="Internet Services" content-type="text/html"

However, this was not the case. According to virus total ,avira sees that as malware
https://www.virustotal.com/url/1306b95314166571070869cc804ca15e91a734fd24f72565117c4566b9deaa4f/analysis/1336217603/
but is not blocked

Thanks

0 Sn@g9l3pu5s over 12 years ago

I have also been Testing UTM 9 against other firewall/security gateways

testing the UTM virus protection against others to see if would stop

Malicious iframes  Malicious javascript

encoded JavaScript malware   viruses

Fake-AV    Rootkits

Bots      Malware

UTM 9 ASG sophos/avira         VS      clamav with the SaneSecurity Third-Party signatures
out of 80 samples caught 0                            out of 80 samples caught 80

UTM 9 ASG sophos/avira did not stop        clamav stop the viruses at the gateway
virus at gateway

why did UTM 9 ASG sophos/avira not stop badware at the gateway.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

The strange thing is that the endpoint caught the virus on the webpage but i could expect (in my case) avira/sophos to catch this as well (according to virustotal avira can detect this)

Sent from my iPhone using Astaro.org
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to wingman

Hi Wngman,
I have a thread where my sons gaming PCs are attacking an external site, it is always the same site, this shows up in the IPS log/report.

But I was wondering how it got through in the first place. The daily report shows it as being malware. On one PC I think it might have been when the proxy was not working correctly, but the other I am not sure.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

this sounds a different issue since it refers to IPS whereas I am mainly concern about the antivirus engine. Could you open a new thread inc the relevant SID and logs?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to wingman

It is a different issue in that it is inside attacking outside and I have opened another thread, but it is also related to your thread in how did it get past the UTM in the first place.

Ian

forget I even posted a thread on the subject, found the cause and have fixed it hopefully.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

Any updates on this one ?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 snowcrash_01 over 12 years ago in reply to wingman

The strange thing is that the endpoint caught the virus on the webpage but i could expect (in my case) avira/sophos to catch this as well (according to virustotal avira can detect this)

Sent from my iPhone using Astaro.org

Hi Wingman,
Sophos at the Endpoint can be configured to use live lookups, which the UTM does not do at the moment. Therefore the Endpoint may catch a virus which is still unknown to the UTM until next pattern update.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

However, Avira could detect this (as per initial post) and even today I am still seeing only the endpoint blocking it and not avira. I have both engines for scanning enabled and I can verify that neither avira nor sophos UTM detected this

http://whiteejumiller.aa.am/gipoto/dabstepinattack.php

20120517 203444 Blocked web request to "whiteejumiller.aa.am/gipoto/dabstepinattack.php" for user AA000000\wingman. 'Mal/ExpJS-AA' has been found at this website, reference ID 110389852.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 William Warren over 12 years ago in reply to snowcrash_01

Hi Wingman,
Sophos at the Endpoint can be configured to use live lookups, which the UTM does not do at the moment. Therefore the Endpoint may catch a virus which is still unknown to the UTM until next pattern update.

oh great..another cloudy database? am i going to have to make a push to get that one able to be locally loaded too?..[[[;)]]][[[;)]]][[[;)]]]

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago
ok same thing happens if I try to access isohunt.com. My endpoint detects this as

20120522 172720 Blocked web request to "isohunt.com" for user AA000000\wingman. 'Mal/HTMLGen-A' has been found at this website, reference ID 351853.

however, this is not blocked by the UTM by sophos as malware. Don't they use the same engine?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel