This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

INDICATOR-OBFUSCATION Javascript indexOf rename attempt

It seems with 9.103 we are now getting heaps for these

INDICATOR-OBFUSCATION Javascript indexOf rename attempt

This seems to be slowing internet browsing down as well? What is this IPS attack and why is it happing?

This thread was automatically locked due to age.

0 William Warren over 11 years ago

it appears to be a false positive. Theres another user who ran into this issue. I'm not a fan of disabling rules but disabling that one seems like a good idea right now. If you have support get them involved as well.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Make sure to use the SID (snort ID) and not the alert ID when disabling rules.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 stealthmatt_01 over 11 years ago in reply to BarryG

Make sure to use the SID (snort ID) and not the alert ID when disabling rules.

Barry

How do you disabled this using the SID? do you do this through the web interface or the command line?

Thank you
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Go to the IPS settings in WebAdmin, and go to "Advanced" (the last tab on the right)...

Top section is "Manual Rule Modification"; click the '+' icon, and enter the SID, and EITHER click 'Disable' or change to ALERT.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 stealthmatt_01 over 11 years ago in reply to BarryG

where do you find the SID?

edit: it appears in the logs and corresponds with what is actaully on the page itsself.

I have set this to alert only. Thanks all
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 11 years ago in reply to stealthmatt_01

in the log, it's right after "sid="

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 11 years ago in reply to BrucekConvergent

Oh duh, just read your edit, you figured it out [:)]

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 xenon2008 over 11 years ago

Hi,

The other user is me =)
Since i have disabled this rule everything works fine! SID Number is: 26616

My thread:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/41112

Xenon

Sorry for any short responses! Sent from my iPhone using Astaro.org
Cancel
Vote Up 0 Vote Down

Cancel
0 namon96 over 11 years ago

It seems with 9.103 we are now getting heaps for these

INDICATOR-OBFUSCATION Javascript indexOf rename attempt

This seems to be slowing internet browsing down as well? What is this IPS attack and why is it happing?

I came on this thread after having problems with AWS and needed to disable rule 23350.

AWS now works, but I'm not sure this is the best solution, disabling and entire rule for one website

Any ideas

Cheers
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Hi, I generally agree with you that rules should not be disabled because of one website, but looking at
Snort :: Changes 2013-05-09
it appears that Snort.org leaves these rules disabled by default (likely due to high false-positive rates), and Sophos has chosen to turn them on.

I'm finding that BallardDesigns' website won't work without disabling sid 26616, on UTM 9.006; "INDICATOR-OBFUSCATION Javascript indexOf rename attempt".

Barry
Cancel
Vote Up 0 Vote Down

Cancel