I recently bought and Installed a WAF (after much begging).

I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is mycompany.com

Users are mapped to DFS namespace \\mycompany.com\ourfiles\etc\

Now my WAF is reporting a generic attack disclosure from IPs originating from my surrounding geographic area pointing at mycompany.com\ourfiles\etc\ Using Microsoft-WebDAV-MiniRedir/6.1.7601 (which is a Windows 7 WebDAV if I remember) over HTTP. I assume from users that took there laptops home.

Sometimes the folder path showing up is very specific, however not out of the ordinary for someones shortcut.

My question is how should I tackle this? I know the WAF will report just about anything odd. I am able to easily replicate this report by manually trying to map a network drive outside my network. \\mycompany.com\files\etc\

When I try to use a domain joined system from an external WAN to try to replicate this issue without manual mapping I am not able to. Also WebDav or Windows Authentication is not installed on the web server.

Edit: For clarification is there a security concern here? or is it completely benign?

  • Are you concerned about the security of the clients or the server? – Neil Smithline Sep 8 '15 at 22:14
  • Well both. Windows is sending a automatic WEBDAV attempt to my web server using the file path in my File-server, which I didn't think windows does. I guessing i am trying to see if anyone has ever experienced this and how they dealt with it. I have come up with the solution of removing the .com from the DFS. It seems to still work without it. Though still dont know what the security implications from this are. – Sarge Sep 8 '15 at 22:17

I believe that Win 7+ will automatically attempt to connect to a WebDAV service if it's link formatted as you have it, thinking that the service is on a remote system somewhere. (IE under a mapped drive doing something like \\example.com\folder\ will trigger MS to look for external services in that domain using WebDAV)

Method 1

If you have no WebDAV service for external users, just filter out all WebDAV traffic. Let it get logged and you can probably lower/disable the notification threshold.

Method 2 - Not recommended

I believe Windows has a way to disable WebDAV on the Laptops. This might invariably break something else, but it's worth looking into if your company doesn't use the service. (This will create a user complain train if it breaks something they use frequently, company related or not)

Security Concerns

If your company doesn't rely on WebDAV for anything and you block all inbound communication of WebDAV traffic you have minimal impact. There isn't anything really pressing about the WebDAV triggers that makes you go, OMG WE'RE DOOOOOMED, based on you initial analysis of it (I think you right to assume they are false positives). At this point it's baseline for you to look at, unless an attack has active knowledge of your directory structure, trying random WebDAV request will be pretty obvious even among the false positives.

In short, your pre warning will be hindered slightly, if you get accustomed to seeing tons of false positives.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.