Solved

Sonicwall tz100 (hacked?): default rule any any allow

Posted on 2014-02-10
6
719 Views
Last Modified: 2014-02-11
Hi,

I have a device on my network that was compromised. Couldn t logon to it, no ssh nothing.
Now, I try to limit accesses on my sonicwall.

I see a rule from any to any allow. That is not a default rule right? This would mean also my sonicwall user and pass are known.

Please advise.
J.
0
Comment
Question by:janhoedt
  • 4
  • 2
6 Comments
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39848529
Hi janhoedt,

It depends, by default Zones are set to Deny. Which Zones are they for?

The attacker would only know which users of the machine compromised and even then only if they have setup a sniffer or keylogger - just because they have been compro9mised doesn't necessarily point to any particular threat but rather that vulnerabilities have been exploited. Therefore, unless you are using SSO or have aligned the user's credentials with the ones in the SonicWALL. Even then someone would have to know not only their way around a SonicWALL but know that a user account has been setup there as well. Furthermore, unless they have admin access it they will not be able to change any settings within the SonicWALL but they will have access to whatever that user has access to inside the network. Change user credentials on the SonicWALL immediately for that user.

Let me know if you have any other questions!
0
 

Author Comment

by:janhoedt
ID: 39849482
Thanks.

The access rule is the following (system made access rule, I've set it on deny now):

 46      LAN      >      WAN      11      Any      Any      Any      Allow All      None                    Enabled        Edit this entry A service depends on this rule
0
 
LVL 25

Accepted Solution

by:
Diverse IT earned 500 total points
ID: 39849710
Awe, OK in this case LAN > WAN is completely normal to have it as Allow Any Any All. Unless you are filtering outbound traffic for PCI or some other compliance/security reason, the default for LAN > WAN is Allow and should be otherwise nothing will go outbound (no email, can't browse web, etc.).

Make sense?
0
Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

 

Author Comment

by:janhoedt
ID: 39849894
I'd like to explicitely allow or disallow so have put it on dissalow.
0
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39849906
Then you need to have the LAN > WAN Deny rule as the last rule in priority. Then explicitly allow each service above it in priority.

Any other questions?
0
 
LVL 25

Expert Comment

by:Diverse IT
ID: 39849956
Glad I could help...thanks for the points!
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
I've been an avid user and supporter of Malwarebytes Premium Version 2.x for years. It's an excellent product that runs alongside just about any Anti-Virus application without issues. It seems to have an uncanny ability to pick up many things that A…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question