topic Re: PA blocks spyware - identify compromised computer in General Topics

PA blocks spyware - identify compromised computer

Sven_Lieckfeldt — Wed, 17 Jun 2015 07:04:15 GMT

Hi there,

we're running the following setup:

trusted zone | DC zone | Internet

Client/Proxy/some old DNS Server| DNS Server| Internet

I see that the PA is blocking malware traffic (app DNS). But the attacker is either the proxy, asking the DNS in the DC zone, or the old DNS server, asking DNS servers in the Internet.

Unforunately that way I don't get the compromised machine.

What do you guys have in place to identify such computers? Put the proxy and the old DNS in a different zone? Or is the DNS sinkhole the way to go?

Thanks for your suggestions.

Cheers,

Sven

Re: PA blocks spyware - identify compromised computer

pulukas — Wed, 17 Jun 2015 10:32:58 GMT

In order for the PA to identify the computer the traffic would have to cross the PA from the computer to the DNS server or from the computer to the proxy.

For the proxy server requests I would check the proxy logs for the DNS record and see if it logs that site as visited by a user.

For the DNS server if you did put this into its own dmz like zone then all traffic to the DNS would get seen and logged. But be careful what you ask for. This will generate a LOT of logs and will thus shorten the time frame of available logs on the PA. DNS is used very frequently on a modern network. A single page load can generate 10 dns requests easily.

Re: PA blocks spyware - identify compromised computer

Sven_Lieckfeldt — Thu, 18 Jun 2015 14:47:48 GMT

Hi Steven,

thanks for your answer!

We're not logging allowed traffic to avoid logs blowing our firewall. So that would be fine.

So I've the following options:

- put proxy's into another zone

- scan the proxy logs

Cheers,

Sven

Re: PA blocks spyware - identify compromised computer

HITSSEC — Thu, 18 Jun 2015 19:27:03 GMT

Sven,

Would using the sinkhole feature within your Anti-spyware Profile help? We have a situation where the user to DNS server communication does not traverse the firewall. By using the sinkhole response on DNS signatures you can see who is going to the sinkhole IP address (because you define it and force the traffic to it to traverse the firewall ). Certainly this is useful in helping you to look a bit more closely at specific source IP addresses on your network. DNS sinkhole is one of those red flags to help you identify unusual or suspicious traffic.

Hope this helps,

Phil

Re: PA blocks spyware - identify compromised computer

rkoenig — Sun, 21 Jun 2015 20:07:21 GMT

I was wondering the same thing. (DNS Sinkhole)

I'm getting ready to implement it on our firewall.

Re: PA blocks spyware - identify compromised computer

scantwell — Mon, 22 Jun 2015 15:48:16 GMT

I have implemented SinkHole and it works awesome.

thanks

Re: PA blocks spyware - identify compromised computer

pulukas — Mon, 22 Jun 2015 22:36:50 GMT

Thanks for the update. Sink hole has been on my list to get rolled out for a while. I need to get this setup.