Since upgrading from 9.2x to 9.307 yesterday I do get ATP warnings:
e.g.
A threat has been detected in your network
The source IP/host listed below was found to communicate with a potentially malicious site outside your company.
Details about the alert:
Threat name....: C2/Generic-A
Details........: C2/Generic-A - Viruses and Spyware - Web Threat, Virus and Spyware Detection and Removal | Sophos - Threat Center - Cloud Antivirus, Endpoint, UTM, Encryption, Mobile, DLP, Server, Web, Wireless Security, Network Storage and Next-Gen Firewall Solutio
Time...........: 2015-02-10 08:24:53
Traffic blocked: no
Internal source IP address or host: 192.168.0.38
.38 and .39 are our internal DNS.
The logfiles shows following details:
/var/log/aptp.log:2015:02:11-15:06:49 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.38" dstip="213.218.169.74" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:07:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:07:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:09:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:09:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:11:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:11:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:13:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"
/var/log/aptp.log:2015:02:11-15:13:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"
213.218.169.74 is our legal external DNS to which all unresolved DNS-Requests are forewarded.
panthera.sytes.net and thomasius.sytes.net are dynDNS entries for a custom Synology NAS with redirection to :5000 with a dedicated FW-Rule to allow traffic from the LAN to that host and port.
This construction was working flawlessly for months until the upgrade to 9.3x.
The questions are:
A) Are both these hosts on a blacklist and how could one remove them?
B) How could I check what is inside fwrule"63001"? An
"iptables -nL -v --line-numbers"as usual is not helpful at this point.
C) Does the UTM depackage IP-Packets to look inside for a blacklisted string? Otherwise I cannot explain the declaration of simple DNS-Requests of blaclisted hosts not going to any C&C Server as "bad"
D) Any ideas to stop this?
Thanx - Chris
This thread was automatically locked due to age.
