topic Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ? in General Topics

Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

MCmgt — Fri, 25 Sep 2015 13:29:30 GMT

Before I go on a wild goose chase, has anyone seen an increase in threat 30419 (RFC2397 Data URL Scheme Usage Detected)?

It seems like these things trip for a while until PA figures out someone's using something novel in a new App. A new application sig comes out and the alerts go away...

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

ulti — Fri, 25 Sep 2015 21:16:10 GMT

thank goodness - its not just me. yes, we've seen a huge increase in these and wasn't sure if we should negate these in the policy or if Palo's threat team jacked with the settings in a recent db update. (known to happen)

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

ulti — Fri, 09 Oct 2015 15:51:44 GMT

anyone have thoughts on this? seems noisy for us. Can't tell if Palo changed it in threat db or if there's just a huge increase of it on net.

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

MCmgt — Wed, 14 Oct 2015 17:28:51 GMT

I opened a case (00389881) yesterday. They've heard rumblings from customers but hadn't received any pcaps yet.

By chance, I stumbled across someone tripping the sig and called them. They got red-faced when I asked them what they had just done...visited okmagazine.com. Sure enough, I was able to reproduce it and support has a pcap to look at.

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

ulti — Wed, 14 Oct 2015 17:35:35 GMT

let us know what the outcome is, we're getting these daily whereas we've never had them prior to about a month or so ago

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

MCmgt — Wed, 14 Oct 2015 18:56:37 GMT

This particular instance was a TTF (TrueType Font) file, and that the purpose of the javascript containing it looked to be css/style/ad delivery using JWPLAYER.

Advertising...

YMMV.

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

ulti — Tue, 03 Nov 2015 16:35:06 GMT

Did you mark it as exception and allow or are you still alerting on it?

Re: Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

jambulo — Wed, 18 Nov 2015 22:05:24 GMT

We've been getting a lot of hits on this Threat ID as well. I think if anything, this ID should be set to Informational or Low.