topic Re: DNS Spyware Vulnerabilities - Why aren't the FQDNs in Malware Category? in General Topics

DNS Spyware Vulnerabilities - Why aren't the FQDNs in Malware Category?

networkadmin — Tue, 27 Jan 2015 17:14:20 GMT

Today I switched on the "strict" Spyware anti-spyware policy on my outbound Domain Controller DNS policy - I'm seeing a lot (I mean a lot) of requests blocked for things like advertising networks.

Here are 3 DNS queries that were blocked, and they're indicative as I've picked them at random:

d.audienceiq.com

d.p-td.com

p.adsymptotic.com

Those flag as spyware domains.

So how come when I do a URL filtering query (using PAN-DB) on those domains that they show as Business & Economy, Financial, and Computer and Internet Info?

They don't show as adverts or malware or anything like that.

Surely if someone has put them into the vulnerability database they should be in the URL database under a "bad" category shouldn't they?

Does anyone have any suggestions please?

Re: DNS Spyware Vulnerabilities - Why aren't the FQDNs in Malware Category?

HULK — Tue, 27 Jan 2015 17:18:50 GMT

Hello Networkadmin,

In the event that a URL has been mis-categorized, a change request can be submitted in one of two ways: Please follow the KB doc mentioned below.

How to Submit a Mis-Categorized URL for PAN-DB

Hope this helps.

Thanks

Re: DNS Spyware Vulnerabilities - Why aren't the FQDNs in Malware Category?

networkadmin — Tue, 27 Jan 2015 17:25:01 GMT

Hulk, thanks and I get that I can do that, but I think the point for Palo Alto here is that I don't know if it's a good URL or a bad URL and Palo Alto are contradicting themselves with their behaviour IMO.

d.audienceiq.com
d.p-td.com
p.adsymptotic.com

How am I supposed to know what those are? :smileylaugh:

Palo Alto must know it's bad else why is it in the vulnerability database as suspicious/spyware - someone at Palo Alto must have updated the database?

So if it's known bad why would it not be listed in a suitable category for URL filtering automatically?

You see what I'm saying hopefully?

Re: DNS Spyware Vulnerabilities - Why aren't the FQDNs in Malware Category?

HULK — Tue, 27 Jan 2015 17:38:28 GMT

Hello Networkadmin,

I do understand your query

The PAN-DB classification engine is based on machine learning, so we can and are constantly tweaking the individual category models to improve. In regards to URLs that are categorized as spyware, this is usually due to the fact that WildFire has detected malicious activity to/from this domain. Hence, we keep updating our database based on the wildfire result too.

A related discussion for your reference: Suspicious DNS Query ad nauseam

Thanks