Skip to main content
razor
razor
Visitor III
February 21, 2016
Solved

Locky.Ransom SMTP invoice block rule

  • February 21, 2016
  • 11 replies
  • 11943 views

Hi there Specialists,

I have a question regarding custom IPS rules. I've wrote multiple IPS custom rules to prevent locky infections. The rules contains a pretty common attachment name, but for now it's being used by the locky ransomware so we would like to block all the SMTP attachment containing the name we defined ( see rules ).

 

The rules are:

#SMTP F-SBID ( --name "ITCustom.Locky.SMTP.TCP.Feb21-1"; --protocol tcp; --ipver 4; --pattern "invoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.TCP.Feb21-2"; --protocol tcp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "ITk.Custom.Locky.SMTP.UDP.Feb21-1"; --protocol udp; --ipver 4; --pattern "incoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.UDP.Feb21-2"; --protocol udp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; )

 

#HTTP

F-SBID ( --name "IT.Custom.Locky.HTTP.Feb21-1"; --protocol tcp; --ipver 4; --pattern "/main.php"; --context uri; --service HTTP; )

 

Apparently the SMTP rules are not working. The HTTP rule does.

 

Could someone help me out? :) Thanks in advance!

 

 

    Best answer by romanr

    Hi,

     

    with deep-inspection properly enabled the Fortigate will also intercept the TLS handshake in the SMTP session!

     

    But be careful - the Fortigate will the present its certificate to the client!! Which is mainly no problem between servers - but a major problem if you have Outlook or Thunderbird or whatever clients also connecting to that server via SMTP! These clients might not easliy accept a FGT certificate without user interaction!

     

    Br,Roman

     

     

    11 replies

    emnoc
    emnoc
    New Member
    February 21, 2016

    A few quick items, did you run diag debug flow against the mail?

     

    SMTP does not use udp

     

    If the SMTP session is  ssl/tls that rules will not work unless you de-encrypted the session.

     

    last, your using the body but I think it should be  the HEADER for inspection on "content". The SMTP dialog should list the  doc in question in the header.

     

    can you  re-write the 2  SMTP patterns and content  set for HEADER and not the body?

     

     

    razor
    razorAuthor
    Visitor III
    February 22, 2016

    Thanks emnoc, I tried the HEADER context but it doesn't work either. I check the tcp flow using Wireshark, and it seems to be encrypted. I'll try the DPI module within a few days.

    emnoc
    emnoc
    New Member
    February 22, 2016

    The encryption needs to be removed in-order to peek into the flow. SMTP is commonly  used with SSL/TLS ;)

     

    razor
    razorAuthor
    Visitor III
    March 3, 2016

    I'm not able to block encrypted SMTP emails while DPI enabled.

     

    Is there any Fortinet Employee who is able to give us useful tips? Like a best practice?

    romanr
    romanrAnswer
    New Member
    March 3, 2016

    Hi,

     

    with deep-inspection properly enabled the Fortigate will also intercept the TLS handshake in the SMTP session!

     

    But be careful - the Fortigate will the present its certificate to the client!! Which is mainly no problem between servers - but a major problem if you have Outlook or Thunderbird or whatever clients also connecting to that server via SMTP! These clients might not easliy accept a FGT certificate without user interaction!

     

    Br,Roman

     

     

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!