Gizmodo/Lifehacker being blocked.

[YourIT]

Here's a weird one... Gizmodo.com and Lifehacker.com are being blocked by Untangle. When attempting to visit one of these sites, the following info is logged:

#2441: WEB-MISC NetObserve authentication bypass attempt

[greebo]

Originally Posted by YourIT

Here's a weird one... Gizmodo.com and Lifehacker.com are being blocked by Untangle. When attempting to visit one of these sites, the following info is logged:

#2441: WEB-MISC NetObserve authentication bypass attempt

I'm gettinng this today for people trying hit www dot nab.com.au

"#2441: WEB-MISC NetObserve authentication bypass attempt 203.57.240.103:80"

[eddyg]

Yip, same here also with all my clients trying to reach Internet Banking at nab.com.au.

Not sure what rule 2441 does and if it's a recent update but I'm presuming not as the ID number is very low compared to the list there is currently.

This would suggest NAB has either changed some authentication method / site redirection or there is a genuine problem at NAB that they should be made aware of.

Anyone have any clues on this?

[adrianp918]

i have no problem getting to any of these sites

[greebo]

No problems with gizmodo or lifehacker, just the NAB. Mostly off the internet banking link, which I can't post the URL for as I have to get my post count up.

If I swtich rule #2441 to log only or off its all happy.

[eddyg]

Originally Posted by adrianp918

i have no problem getting to any of these sites

You might not have a problem getting to www.nab.com.au but once there, try clicking on Login, on the right hand side, for Internet Banking. Thats when it brings up a another window and it fails at that point.

I've just tried it myself and it also works fine on my network but at my clients the pop up window comes up with:Internet Explorer cannot display the webpage

As soon as you turn off Intrusion Prevention, all works 100% fine.

You can see the block on the IP logs on Untangle.

[dmorris]

Originally Posted by eddyg

As soon as you turn off Intrusion Prevention, all works 100% fine.

I would suggest disabling Intrusion Prevention or disabling that rule if it is causing false positives for you.

[adrianp918]

i clicked on the login button......i was able to get all the way into the point to where i needed to enter a username and password

[eddyg]

Originally Posted by adrianp918

i clicked on the login button......i was able to get all the way into the point to where i needed to enter a username and password

Ye, like I said, working on my network too but not so on my client's network.

[DancesWithBikers]

I'm seeing it too: Lifehacker, Jalopnik, Kotaku, and Gizmodo.

Besides #2441, it's also logging #1201: ATTACK-RESPONSES 403 Forbidden

Clearing #2441 restores normal function.