Psiphon Explanation

Forum|Forum|7 years ago
February 1, 2019
2 replies
10366 views

Can someone explain what this psiphon event is? I've confirmed I don't see an installation of psiphon on the user's computer. the direction is incoming, hopefully something triggered by ads on WSJ.com. I'd like to confirm the computer is not infected with anything.

TriggerUTM App Ctrl Event - Proxy

Log Details:

logver 60 Type utm Sub Type app-ctrl Event Type app-ctrl-all Level information Application ID 32642 authserver Local FSSO Agent Destination IP 13.249.142.119 Source Port 60132 Destination Port 443 Source Interface port3 srcintfrole lan Destination Interface port1 dstintfrole wan Protocol 6 Service HTTPS Direction incoming Application Category Proxy Application Psiphon Action pass Threat Score 10 Threat Level medium Host Name newsletter-images.wsj.com Incident Serial No. 430703357 URL / Message Proxy: Psiphon, Application Risk critical scertcname newsletter-images.wsj.com

JohnGeorgeAuthor

New Member

Anyone?

rr_FTNT

Staff

Direction is incoming with relation to Fortigate. You can see it is LAN->WAN so something on the user's computer was destined for port 443 on host. There are open nodes on the psiphon network that doesnt require client software to be loaded. http://booki.flossmanuals.net/circumvention-tools/ch016_using-psiphon2-open-nodes Not sure if this is what you are seeing, but just more info.

mpoteet

New Member

I'd just like to add that since 2.8.2019 I've seen this signature pop up for traffic going to a myriad of websites, coming from a handful of workstations that do not appear to have the psiphon application installed. I'm currently leaning towards a theory that the signature for this application got an update or something and now it's causing false positives, but that's just my theory. I have a ticket opened for it.