Hi all, which category should I enable on the "Webserver Protection", "Firewall Profiles", "Common Threat Filter Categories" to block log4j related attacks?
Thanks for any help!!
This thread was automatically locked due to age.
Hi all, which category should I enable on the "Webserver Protection", "Firewall Profiles", "Common Threat Filter Categories" to block log4j related attacks?
Thanks for any help!!
I thought these were already being blocked by snort rules? According to the IPS rule sheet the snort SIDs are there. So wouldn't the rule be applied no matter which you would choose?
OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Hi Amodin, so to understand well, the snort rules are the default ones already integrated in the IPS filter and that regardless of the categories that I can choose in the WAF filter, they will always be applied and cannot be disabled, is that correct?
Hi Amodin, so to understand well, the snort rules are the default ones already integrated in the IPS filter and that regardless of the categories that I can choose in the WAF filter, they will always be applied and cannot be disabled, is that correct?
That's how I *think* it works, but I could be wrong. If I am, I'd like to know myself. Hence, why I was sort of asking the question myself, haha.
OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Sophos does not use the standard Snort rules "only". Sophos builds own snort rules.
You find all related signatures in the Advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20211210-log4j-rce
__________________________________________________________________________________________________________________
We know the product itself is not vulnerable to it, he asked what settings to enable in WAF to prevent devices behind it from being affected. Do any of the profiles work for this? None? Is my question/statement accurate?
OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
I am assuming this is the article you mentioned: Log4Shell explained – how it works, why you need to know, and how to fix it – Naked Security (sophos.com)
Thank you for mentioning this, I had not seen it.
OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Maybe this is another good approach: https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/
__________________________________________________________________________________________________________________