topic Re: Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784 in General Topics

Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784

nextgenhappines — Sat, 09 Jun 2018 14:52:18 GMT

Hi,

Anyone else notices increase amount of Suspicious HTTP Response Found ID 54319 after installed AppID 8029-4784?.

The threat vault description This signature detects a suspicious HTTP response

Category protocol anomaly

PANOS Min version 8.0.0

Severity low

Action Alert

Fire release 785

Want to see if others are seeing the same thing on their firewall? It looks like it is catching http get file transfer. What makes it suspicious?

Re: Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784

BPry — Sun, 10 Jun 2018 02:04:35 GMT

@nextgenhappines,

I've noticed an uptick, but it's something that I notice quite a lot anyways with our users.

Re: Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784

nextgenhappines — Sun, 10 Jun 2018 14:42:13 GMT

Try to understand "suspicious HTTP response" means from PAN point of view, it will be nice to have a more descriptive explaination. It is a low severity, but why is it set to alert?

Re: Suspicious HTTP Response Found (ID 54319) after updated to 8029-4784

BPry — Tue, 12 Jun 2018 13:06:39 GMT

@nextgenhappines,

Unfortunately they kind of stopped publishing exactly what the signature in question is looking for, however all of the Suspicious HTTP Response Found signatures all focus on looking for different characters in the HTTP response header. For example '40400' looks for "x00". They essentially are looking for a character set that shouldn't actually exist in the response header.

The real issue is that most people don't take the standard seriously and include whatever they want within the response header because generally it doesn't cause any issues. Its set to alert because you can actually use the response header to give commands to infected machines. So if an infected machine reaches out to a CnC server it can put control information within a response header.

I'll clarify this by saying that there is a lot of services that don't actually respect RFC 2616 or the further defined RFC 7230. Slack is one that I can think of at the moment that is horribly out of scope and is rightfully identified but is a known application.