Advanced Threat Protection

Does anyone experiencing this happen to have public IPs, "Any", or "Internet" listed under Network Services > DNS > Global > Allowed Networks?

The DNS proxy is not designed to be left openly internet facing, and if anyone is, they are almost certainly being used as a proxy for DNS reflection attacks. If that's what's happening here, it seems the target of this particular attack, is also something we detect via ATP. 

-Alan

Does anyone experiencing this happen to have public IPs, "Any", or "Internet" listed under Network Services > DNS > Global > Allowed Networks?

The DNS proxy is not designed to be left openly internet facing, and if anyone is, they are almost certainly being used as a proxy for DNS reflection attacks. If that's what's happening here, it seems the target of this particular attack, is also something we detect via ATP. 

-Alan

no only internal network listed.

I saw this on multiple clients (over 10) -- The are all set to only internal for DNS Allowed Networks.  The only clients I have that were not affected are ones that geoblock China.

Alan,

thank you for your post. I am sure in Sophos you have analyzed this behaviour. Could you share the analysis's output to community?

This will eliminate the needs to contact the Support.

Thanks.

All our clients are set up with internal only DNS allowed, if it was hitting my test firewall I'd love to packet capture and allow the attack to happen to see what it is but sadly our own firewalls were ignored with this :(

One of our clients had Support enter their machine and do a packet capture and have a record of the raw attack on the box as it was still happening but the contents were complete gibberish.

Maybe they weren't hit because the portscan from china was unsuccessful?

If a device doesn't block china, the portscan can poke and see that something is there so then they try hitting it again, hard.

(apologies for double post, I still mistake what bloody page I am on because it doesn't tell me unless I check and recheck all the time)

I too received these alerts.  I am new to this.  I have a host that is unable to connect to the web.  Curious if the UTM blocks outbound traffic of a host if a threat is detected?  If so, how do I unblock outbound traffic and get my host back up and running? 

I can successfully ping google dns: 8.8.8.8

But, browser will not connect?