Netgate SG-1000 microFirewall

Author Topic: uBlock Origin - A NETWORK TROJAN - False Positive  (Read 1199 times)

0 Members and 1 Guest are viewing this topic.

Offline Fobio

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
uBlock Origin - A NETWORK TROJAN - False Positive
« on: November 04, 2016, 12:34:23 pm »
I've caught a false positive and maybe this will help others out.  If there's a resource or list with these that I can use, please point me in the right direction.

I've posted the following to uBlock Origin:

https://github.com/gorhill/uBlock/issues/2125#issuecomment-258384913

Quote
Behind a pfsense router/firewall and I've been reviewing my firewall logs and 3 out of 4 PC's are running uBlock Origin and of the 3, 2 run it in Chrome. I've noticed that the 2 PC's that run uBlock in Chrome is triggering a NETWORK TROJAN warning, with a dest ip of 213.230.210.230 port 443. The 3rd PC runs a VPN and all traffic is routed through it, so it is bypassing the firewall. I've searched online and found that the trigger is that IP being associated with a botnet C&C server and triggering an alert.

https://feodotracker.abuse.ch/host/213.230.210.230/

I initially thought that I was infected with malware that is connecting to the botnet server and I didn't find much online. After some more digging, I've found that dest ip of 213.230.210.230 port 443 may be the location of a host file for uBlock. But I can not confirm this. I'd like to confirm whether this is the case so I can put my mind at ease and disable the rule in snort.

IP: 213.230.210.230
Port: 443
URL: boo.yoyo.org

Chrome version: Version 54.0.2840.87 m (64-bit)
uBlock Origin version: uBlock Origin v1.9.16
Default filter list
No custom filters

To which I've gotten a speedy reply:

Quote
False positive.

This IP belongs to the Peter Lowe’s Ad server list which you obviously have checked. The links for the lists can be found here. You should report this to the Snort developers - not a uBlock Origin issue.

Link for host file links: https://github.com/gorhill/uBlock/blob/master/assets/ublock/filter-lists.json#L233

I'm going to proceed and suppress the alert for this IP but I have a feeling there are others like this out there too.
« Last Edit: November 04, 2016, 12:57:13 pm by Fobio »

Offline Stewart

  • Full Member
  • ***
  • Posts: 231
  • Karma: +13/-2
    • View Profile
Re: uBlock Origin - A NETWORK TROJAN - False Positive
« Reply #1 on: November 09, 2016, 12:01:27 pm »
Posting here will help us but will likely not do much overall.  Snort is owned by Cisco but they haven't changed the submission form here:  http://blog.snort.org/2011/01/false-positive-submission-form.html to let them know they have a potential false-positive.

I would think that disabling the rule would be a bad long term solution since it would allow the other malicious sites blocked by the rule to be allowed.  My question would be what was going on with the IP that it would be reported as bad. Maybe as an Ad server it was compromised?

Offline u3c307

  • Jr. Member
  • **
  • Posts: 41
  • Karma: +8/-0
    • View Profile
Re: uBlock Origin - A NETWORK TROJAN - False Positive
« Reply #2 on: November 09, 2016, 10:44:08 pm »
I have ublock on all my pc but no alert in snort. You sure it's not adblock plus usually use yoyo?

Offline Impatient

  • Newbie
  • *
  • Posts: 14
  • Karma: +1/-0
    • View Profile
Re: uBlock Origin - A NETWORK TROJAN - False Positive
« Reply #3 on: November 11, 2016, 12:04:35 pm »
I also had that ip 213.230.210.230 flagged by snort but it was Not a false positive.

It is being handled though.

Offline wifiuk

  • Jr. Member
  • **
  • Posts: 79
  • Karma: +1/-0
    • View Profile
Re: uBlock Origin - A NETWORK TROJAN - False Positive
« Reply #4 on: November 14, 2016, 06:26:02 am »
omg, i have been getting a similar trojan alert and its driving me mad trying to work out where it is coming from

https://forum.pfsense.org/index.php?topic=121123.0

i also have ublock origin, but my snort rule is only showing src as WAN. now how can i tell if this is a false positive if i cant find the local ip