Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 26 replies
  • Subscribers 1 subscriber
  • Views 24893 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ATP reports DNS requests as malicious"

Chris69
Maybe it has something to do with this Thread - but I am not sure.

Since upgrading from 9.2x to 9.307 yesterday I do get ATP warnings:

e.g.
A threat has been detected in your network
The source IP/host listed below was found to communicate with a potentially malicious site outside your company.

Details about the alert:

Threat name....: C2/Generic-A
Details........: C2/Generic-A - Viruses and Spyware - Web Threat, Virus and Spyware Detection and Removal | Sophos - Threat Center - Cloud Antivirus, Endpoint, UTM, Encryption, Mobile, DLP, Server, Web, Wireless Security, Network Storage and Next-Gen Firewall Solutio
Time...........: 2015-02-10 08:24:53
Traffic blocked: no

Internal source IP address or host: 192.168.0.38

.38 and .39 are our internal DNS.

The logfiles shows following details: 

/var/log/aptp.log:2015:02:11-15:06:49 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.38" dstip="213.218.169.74" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:07:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:07:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:09:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:09:50 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:11:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:11:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:13:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="panthera.sytes.net" url="-" action="alert"

/var/log/aptp.log:2015:02:11-15:13:51 berlin-1 afcd[16209]: id="2023" severity="warn" sys="SecureNet" sub="packetfilter" name="Packet logged (ATP)" srcip="192.168.0.39" dstip="50.31.129.129" fwrule="63001" proto="17" threatname="C2/Generic-A" status="1" host="thomasius.sytes.net" url="-" action="alert"



213.218.169.74 is our legal external DNS to which all unresolved DNS-Requests are forewarded.

panthera.sytes.net and thomasius.sytes.net are dynDNS entries for a custom Synology NAS with redirection to :5000 with a dedicated FW-Rule to allow traffic from the LAN to that host and port.

This construction was working flawlessly for months until the upgrade to 9.3x.

The questions are:

A) Are both these hosts on a blacklist and how could one remove them?

B) How could I check what is inside fwrule"63001"? An 
"iptables -nL -v --line-numbers"
 as usual is not helpful at this point.

C) Does the UTM depackage IP-Packets to look inside for a blacklisted string? Otherwise I cannot explain the declaration of simple DNS-Requests of blaclisted hosts not going to any C&C Server as "bad" 

D) Any ideas to stop this?

Thanx - Chris


This thread was automatically locked due to age.
Parents
  • 0
    Because sytes.net is dynamic DNS it is used by a bunch of badguys.  I can see there are a lot of callhome sites via them - but not the ones you list.  Perhaps something in ATP is getting confused.  On my UTM with ATP on, I can browse via the proxy to both URLs.

    A) Contact Sophos Support.  They may or may not be able to help.
    B) Try "iptables-save".  63001 is an ATP block
    C) This logged proto 17 (UDP) and it is AFC (application firewall control).  AFC is used for a bunch of APT protection.  I don't know if the block in question is due to the ip or domain.
    D) Within Network Protection \ Advanced Threat Protection, under Threat Exceptions add both the domain names and IPs, see if that works.
  • 0 in reply to Michael Dunn

    D) Within Network Protection \ Advanced Threat Protection, under Threat Exceptions add both the domain names and IPs, see if that works.


    Unfortunately it does not work. Still getting these annoying ATP-Warnings about simple DNS-Requests. Any further ideas are welcome...

    thnx - Chris
Reply
  • 0 in reply to Michael Dunn

    D) Within Network Protection \ Advanced Threat Protection, under Threat Exceptions add both the domain names and IPs, see if that works.


    Unfortunately it does not work. Still getting these annoying ATP-Warnings about simple DNS-Requests. Any further ideas are welcome...

    thnx - Chris
Children
No Data