Sophos live protection causing excessive connections to Sophosxl.net

[hallb15]

I've been checking our firewall logs and noticed a huge amount of connections to sophosxl.net

Over the last 7 days we have had 219,874 connections to sophosxl.net. That's 12% of all connections!

 

sophosxl.net is used by Sophos clients (not the server) to look up the most up to date threat info directly from SophosLabs without waiting for the definitions to be updated by the local server. They call it Live Protection and I understand how it should work, but it seems excessive to me.

 

I found this article which explains how Sophos Live Protection works in more detail, https://www.sophos.com/support/knowledgebase/111334.aspx

 

Has anyone else had this issue?

Edited March 18, 2016 by hallb15

[psydii]

I'm not sure there is an issue here?

 

Every new file/object a machine encounters will trigger a lookup. That is going to be a huge number of lookups. 12% doesn't seem unreasonable to me.

 

I'll see if I can check, but for us, DNS traffic is forwarded to our ISP so it is harder to analyse.

[tomsie1000]

Had the same here - our Infoblox appliance was listing these as potentially malicious.

 

Bottom line is that Sophos uses a kind of DNS tunnelling to send back file hashes of files it suspects may be malicious or doesn't have any info in the definitions for. It's kinda like the SmartScreen technology that Microsoft has in Windows. You can turn this off by disabling the 'Live Protection' in your Sophos AV policy, but you accept that you'll only be covered for positive identifications that are present in the definition files and more exposed to 0-day or 0-hour infections.

 

Truthfully there's no real way to know how effective that is without asking Sophos, and even if you did they'll (have to) tell you that it works perfectly and you really shouldn't turn it off.

 

In the end, we whitelisted *.sophosxl.net and left it running.