attacking site and PAN

[_slv_]

Hello

Few days ago I discovered site with some information about VMware Update Manager. I had a problem with it and I was searching for solution.

This site is www.bourgelat.net/cannot-patch-definitions-vmware-19988

I have PA with all licences but PAN software doesnt detect any bad traffic

I asked PAN to change categorization to malware site, but today I got email : New category: computer-and-internet-info

This site still trying to hurt Your computer, and PAN doesnt responds to it - is it OK?

I have security policy with thread prevention/av - but it doesnt stops it, hopefully my Symnatec Endpoint protection detecting it and blocking.

You can try to open www.bourgelat.net - this isn't https so in my opinion PAN should react in some way to this traffic.

Do You agree with me?

How it's possible when IE 10 with default configuration recomends to not enter to this site while PAN recategorization is computer-and-internet-info ?

Regards

Slawek

[_slv_]

I can't verify it now, but probably - yes.

Today "www.bourgelat.net/cannot-patch-definitions-vmware-19988" isn't accessable but please try with www.bourgelat.net  Please try with it.

I will check my security rules, but I'm sure that I blocing medium and critical threats.

Regards

SLawek

[gafrol]

I don't see anything threatening on www.bourgelat.net

[gafrol]

Although a google search for "www.bourgelat.net malware" shows very suspicious results...

[_slv_]

Here You are report from today (SEP):

Wykryto zagrożenie

Czas zdarzenia:	19.04.2014 17:33:03
Czas rozpoczęcia:	19.04.2014 17:32:02
Czas zakończenia:	19.04.2014 17:32:02
Wystąpienie:	1
Nazwa sygnatury:	Web Attack: Red Exploit Kit Redirect 2
Identyfikator sygnatury:	26591
Podidentyfikator sygnatury:	71083
Adres URL włamania:	www.bourgelat.net/
Adres URL zawartości włamania:	N/D
Opis zdarzenia:	[Identyfikator SID: 26591] zablokowano atak Web Attack: Red Exploit Kit Redirect 2. Zablokowano ruch tej aplikacji: \DEVICE\HARDDISKVOLUME2\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
Typ zdarzenia:	Zapobieganie włamaniom
Typ hakingu:	0
Istotność:	Krytyczne
Nazwa aplikacji:	/DEVICE/HARDDISKVOLUME2/PROGRAM FILES/MOZILLA FIREFOX/FIREFOX.EXE
Protokół sieciowy:	TCP
Kierunek ruchu sieciowego:	Przychodzący
Adres IP komputera zdalnego:	91.121.93.111
Zdalny adres MAC:	N/D
Nazwa hosta zdalnego:	N/D
Alert:	1
Port lokalny:	55038
Port zdalny:	80

is it a false positive?

Regards

Slawek

[HITSSEC]

Slawek,

We deal with situation by having two custom URL categories:

1. Temporary-Blocked = this allows you to immediately block it while you wait for a reclassification request to be processed by Palo Alto.

2. Custom-Blocked = This allows you to override the Pan-DB or Brightcloud category.  Additionally you can use it to block parts of an otherwise good website.

Hope this provides a way to react quicker.  It works quite well for us.

Phil