Is my Untangle box infected with an exploit?

[mudgie]

I was informed that my IP was responsible for an SSH attack. Analyzing the packets confirmed that it was coming from Untangle rather than the PC behind it. The email performance took quite a hit as well. Would anyone care to weigh in on the issue?

Thanks!

[WebFooL]

Hi,
more info would be nice.
What version of untangle are you running?
What modules are you running?
What coustom installations/mods have you done?

And have you taken the box out of your production env?

[Silver Bullet]

Do you have ssh open for outside access? Maybe it was brute forced??

Run the command "last" on your UT box. It will show you the recent logins and the IP address from which they were initiated.

[mrunkel]

I'm curious what packet analysis could determine that? There is no way to tell if a packet is coming from an untangle or a server behind it unless you have tcpdumps going on both sides.

However, if you suspect it, and you've had ssh open, and it wasn't secured by a packet filter, you should just rebuild the box.

[mudgie]

Hi,
more info would be nice.
What version of untangle are you running?
What modules are you running?
What coustom installations/mods have you done?

And have you taken the box out of your production env?

Thanks for replying. The version is Build 7.0.1~svn20091019r24846release7.0-1lenny. The only modules are spam blocker, phish blocker, virus blocker, attack blocker, and reports. We're using it to filter mail - only the mail server is behind it. There are no custom mods.

[mudgie]

I'm curious what packet analysis could determine that? There is no way to tell if a packet is coming from an untangle or a server behind it unless you have tcpdumps going on both sides.

However, if you suspect it, and you've had ssh open, and it wasn't secured by a packet filter, you should just rebuild the box.

My tech used wire shark. He first listened on the LAN side but saw nothing unusual. Then he joined the WAN side and saw tons of outgoing traffic. We were alerted to the problem by another technician diagnosing our attack on his router. We removed the Untangle from the circuit to quiet the situation down until we could fix or reinstall it.

The WAN adapter was exposed to the public internet, there was no firewall in front of it. We've never opened SSH - I don't even know how!

[mudgie]

Do you have ssh open for outside access? Maybe it was brute forced??

Run the command "last" on your UT box. It will show you the recent logins and the IP address from which they were initiated.

I don't have access to the box remotely at the moment but I'll try that command as soon as I do. How do you open ssh for outside access? I'm not the only admin so it's possible someone else opened it.

[trans_lux]

I recently had a similar issue, we were contacted by our ISP that one of there honey pot's were attacked by something from our IP address. I was unable to find any source for this other than this was on 7.0 with the CLAMAV issues.
Now if we just had real-time monitoring

[mudgie]

I recently had a similar issue, we were contacted by our ISP that one of there honey pot's were attacked by something from our IP address. I was unable to find any source for this other than this was on 7.0 with the CLAMAV issues.
Now if we just had real-time monitoring

Thanks for chiming in. I guess I'll be reinstalling. I thought for sure someone from Untangle would want to get involved...

[dmorris]

Thanks for chiming in. I guess I'll be reinstalling. I thought for sure someone from Untangle would want to get involved...

If you have support give them a call.

If you reinstall do not enable ssh.