topic Re: SFR Module NTP Traffic Blocked in Network Security

SFR Module NTP Traffic Blocked

-Sparrow- — Fri, 21 Feb 2020 17:42:04 GMT

Hello,

Looking at my blocked traffic I see some TOR exit node IP (23.129.64.159). Strange thing is, the initiator IP is my SFR module. It's NTP traffic. What's going on here? Why is my SFR module looking at a TOR node for time? I looked at my FMC and the IP isn't listed in the time configuration.

Re: SFR Module NTP Traffic Blocked

Marvin Rhoads — Tue, 19 Nov 2019 13:13:43 GMT

The time server could have been set on the module during the initial setup. You can rerun that using the script:

/etc/sysconfig/configure-network

...from cli on your module. (you may need to "sudo su -" first)

What (if anything) do you have set on FMC under System > Local > System Policy?

Re: SFR Module NTP Traffic Blocked

-Sparrow- — Tue, 19 Nov 2019 17:14:48 GMT

Hi Marvin,

I don't have any option in my FMC for System > Local > System Policy but I do have System > Configuration > Time which displays this:

The blocked IP isn't listed there.

I ran the

/etc/sysconfig/configure-network

But there wasn't an option for a NTP server there before it completed.

After I ran the configure-network this error popped up in the FMC but it cleared itself up after a few min:

I ran the initial setup a couple of weeks ago when I re-imaged the SFR module, but I don't recall if I saw a setting for NTP there. If it was there it may not have been configured at that time.

Thank you for your help.

Re: SFR Module NTP Traffic Blocked

anousakisioannis — Tue, 03 Dec 2019 12:36:21 GMT

Hello,

I have the same events and most of the devices that initiate this traffic, belong to voice vlan (voip phones).

I haven's also configured this IP, i have left the default servers.

Did you find why this kind of traffic is being initiated from inside?

Thank you

Re: SFR Module NTP Traffic Blocked

-Sparrow- — Tue, 03 Dec 2019 15:12:56 GMT

@anousakisioannis wrote:
Hello,

I have the same events and most of the devices that initiate this traffic, belong to voice vlan (voip phones).
I haven's also configured this IP, i have left the default servers.

Did you find why this kind of traffic is being initiated from inside?

Thank you

It was never clear as to why our SFR module was looking at that IP for time. I raised a ticket with TAC and the engineer had me create a platform setting policy configured to synchronize time with the FMC. Since I set up that platform setting policy I haven't seen the SFR trying to access the TOR IP.

In my case it was only the SFR module that was doing this. I hadn't seen any other devices touching that TOR IP.

Re: SFR Module NTP Traffic Blocked

-Sparrow- — Tue, 03 Dec 2019 15:54:00 GMT

In my case it was only the SFR module that was doing this. I hadn't seen any other devices touching that TOR IP.

I take that back... I just logged in and saw that a one of our field office Xerox printers and our BitDefender appliance tried to access the IP yesterday and the day before. Three occurrences, All port 123 NTP traffic.

Re: SFR Module NTP Traffic Blocked

Marvin Rhoads — Tue, 03 Dec 2019 16:32:20 GMT

It appears from my research using Cisco Umbrella Investigate that the suspect Emerald Onion-registered address is "squatting" on numerous NTP server DNS records. I'm not sure how this has come to pass but I suspect we may see more from Talos Intelligence on this eventually.

In any case, they include 0.sourcefire.pool.ntp.org (and 1., 2. and 3.)

Known domains hosted by 23.129.64.159

Re: SFR Module NTP Traffic Blocked

anousakisioannis — Wed, 04 Dec 2019 08:44:19 GMT

How can we report it to Talos?

Re: SFR Module NTP Traffic Blocked

Marvin Rhoads — Wed, 04 Dec 2019 12:12:31 GMT

You can make a report to Talos using the following URL:

https://talosintelligence.com/reputation_center/support#reputation_center_support_ticket