Solved

Sonicwall tz100 (hacked?): default rule any any allow

Posted on 2014-02-10
6
691 Views
Last Modified: 2014-02-11
Hi,

I have a device on my network that was compromised. Couldn t logon to it, no ssh nothing.
Now, I try to limit accesses on my sonicwall.

I see a rule from any to any allow. That is not a default rule right? This would mean also my sonicwall user and pass are known.

Please advise.
J.
0
Comment
Question by:janhoedt
  • 4
  • 2
6 Comments
 
LVL 24

Expert Comment

by:diverseit
ID: 39848529
Hi janhoedt,

It depends, by default Zones are set to Deny. Which Zones are they for?

The attacker would only know which users of the machine compromised and even then only if they have setup a sniffer or keylogger - just because they have been compro9mised doesn't necessarily point to any particular threat but rather that vulnerabilities have been exploited. Therefore, unless you are using SSO or have aligned the user's credentials with the ones in the SonicWALL. Even then someone would have to know not only their way around a SonicWALL but know that a user account has been setup there as well. Furthermore, unless they have admin access it they will not be able to change any settings within the SonicWALL but they will have access to whatever that user has access to inside the network. Change user credentials on the SonicWALL immediately for that user.

Let me know if you have any other questions!
0
 

Author Comment

by:janhoedt
ID: 39849482
Thanks.

The access rule is the following (system made access rule, I've set it on deny now):

 46      LAN      >      WAN      11      Any      Any      Any      Allow All      None                    Enabled        Edit this entry A service depends on this rule
0
 
LVL 24

Accepted Solution

by:
diverseit earned 500 total points
ID: 39849710
Awe, OK in this case LAN > WAN is completely normal to have it as Allow Any Any All. Unless you are filtering outbound traffic for PCI or some other compliance/security reason, the default for LAN > WAN is Allow and should be otherwise nothing will go outbound (no email, can't browse web, etc.).

Make sense?
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 

Author Comment

by:janhoedt
ID: 39849894
I'd like to explicitely allow or disallow so have put it on dissalow.
0
 
LVL 24

Expert Comment

by:diverseit
ID: 39849906
Then you need to have the LAN > WAN Deny rule as the last rule in priority. Then explicitly allow each service above it in priority.

Any other questions?
0
 
LVL 24

Expert Comment

by:diverseit
ID: 39849956
Glad I could help...thanks for the points!
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Using in-flight Wi-Fi when you travel? Business travelers beware! In-flight Wi-Fi networks could rip the door right off your digital privacy portal. That’s no joke either, as it might also provide a convenient entrance for bad threat actors.
A brand new malware strain was recently discovered by security researchers at Palo Alto Networks dubbed “AceDeceiver.” This new strain of iOS malware can successfully infect non-jailbroken devices and jailbroken devices alike.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now