topic AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking in Firewall and Security Management

AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

CP-NDA — Wed, 23 Jun 2021 04:59:26 GMT

Hi All,

Since a few weeks it's seems that Adblock updates are recognized as Multiple Websites Mine Cryptocurrencies CPU Hijacking by TP

Did you already had same behaviour ?

Time: 2021-01-13T13:30:17Z
Interface Direction: inbound
Threat Prevention Policy Date:2021-01-13T04:05:23Z
Source Port: 62680
Destination Country: United States
Destination: 104.22.66.219
Destination Port: 443
IP Protocol: 6
Session Identification Number:0x5ffef5e9,0x2a,0x9149db70,0xe25c3ad1
Policy Rule UID: 840ff45c-3225-47ab-af3d-3c11e18b4b9a
Threat Prevention Rule Id: 63785ED7-4343-4087-BC81-2D07DA2AD779
Reject Id Kid: 5ffef5e9-29-9149db70-e25c3ad1
Ser Agent Kid: Chrome
Action: Prevent
Type: Log
Policy Date: 2021-01-13T09:12:49Z
Blade: IPS
Service: TCP/443
Product Family: Threat
Action: Inspect
Resource: https://filters.adtidy.org/extension/ublock/filters/16.txt?_=1
Duplicated: 1
Index Time: 2021-01-13T13:31:18Z
Lastupdateseqnum: 85
Attack Name: Web Server Enforcement Violation
Attack Information: Multiple Websites Mine Cryptocurrencies CPU Hijacking
Protection Name: Multiple Websites Mine Cryptocurrencies CPU Hijacking
Protection ID: asm_dynamic_prop_MINE_CPU_HIJACK
Severity: Critical
Confidence Level: Medium
Performance Impact: Medium
Protection Type: IPS
Description Url: MINE_CPU_HIJACK_help.html
Suppressed Logs: 1
Sent Bytes: 1610
Received Bytes: 25470
Bytes (sent\received): 1.6 KB \ 24.9 KB

Thank you

Nicolas

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

G_W_Albrecht — Wed, 13 Jan 2021 15:26:35 GMT

Did you already point this out to TAC in a Content Classification Service Request ?

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

CP-NDA — Wed, 13 Jan 2021 15:29:12 GMT

Hi,

I tried but they forwarded me to a long and annoying SK... sk98820.

We have the same behaviour in multiple infra so I guess we are not the only one to have this false positive.

They didn't accept to try a reproduction in lab 😞

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

osef — Fri, 15 Jan 2021 14:27:32 GMT

I've the exact same problem...

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

Sprunknwn — Sun, 17 Jan 2021 12:06:00 GMT

Hi Nicolas,

Thank you for bringing this to our attention.

Can you please elaborate in regards to which versions are you using and which AdBlock? Are we talking the original getadblock.com Chrome extension?

Or the adblockplus.org ?

Which versions did you experience this behavior on and which IPS db version?

Thanks,

Hertsel

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

Sprunknwn — Sun, 17 Jan 2021 12:16:03 GMT

Hey Nicolas,

Can you also provide the TAC ticket number you opened?

Thanks,

Hertsel

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

Sprunknwn — Sun, 17 Jan 2021 13:05:22 GMT

Just wanted to update that it did replicate on my R81 environment quite easily. We are currently checking this internally.

Thanks,

Hertsel

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

Shiran_Gold — Sun, 17 Jan 2021 18:41:31 GMT

Thanks @Sprunknwn for quick replication which helped understand the behavior.

Hey Nicolas,

Following replication performed and further investigation, we can see that the protection identifies TP as expected.

the original page links to additional pages and one of those pages includes a link to a miner that is prevented from being downloaded by IPS.

If there is still missing information feel free to contact me here or offline.

Thanks

Shiran

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

CP-NDA — Sun, 17 Jan 2021 18:58:23 GMT

Hi Shiran,

Thank you for the feedback really happy to see that it has been handled so quickly ! Thank you @Sprunknwn for your help on this!

I'm really curious to see which link is considered as a miner. We thought that it were clearly a false positive so if you can share that info I will try to double check on different infra to confirm

Thanks again

Nicolas

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

Shiran_Gold — Mon, 18 Jan 2021 08:05:16 GMT

Hey Nicolas,

In general, signature logic is confidential and isn't shared publicly, in order to assist in this specific case, we'll take it offline directly with you.

I sent you a private message.

thanks

Shiran

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

spottex — Wed, 20 Jan 2021 19:43:29 GMT

Ummm... This information would be useful to all!

I.e. The add block company and the URL.

I see one has links to info about mining. One of these wouldn't be it would it?

https://getadblock.com/cryptocurrency-mining/

or this one

https://help.getadblock.com/support/solutions/articles/6000192472-adblock-and-authedmine-com-cryptocurrency-miners

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

Shiran_Gold — Thu, 21 Jan 2021 18:13:42 GMT

Check Point's protection logic is confidential and therefore cannot be shared.
When a specific question arise such as the above, we are working with the customer offline to understand the behavior and assist getting the relevant answer for each individual case.

Re: AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

spottex — Thu, 21 Jan 2021 19:21:54 GMT

Are you talking about the proprietary logic used or the result of the logic?

The statement you have already posted gives away more about the logic than the information I'm asking

i.e. " the original page links to additional pages and one of those pages includes a link to a miner that is prevented from being downloaded by IPS"