IPS statistical submission **PENDING***

Hey all,

 

All of a sudden I am seeing 10 or so IPS Statistical Subission Pending notices a day. 

 

I have had IPS submissions BLOCK a attact before (maybe once a week) but this time its only pending.

 

Does the "PENDING" part mean that it let the attack happen untill it knows for sure its a attack?

 

If it thought it might be a attack then why did it not block the thing and unblock it after it finds out its not a attack.

 

My question to you all is, should I be worried about the "pending" part?

 

Does this mean Nortons is letting the attack happen?

Hello MarcHatzi

 

The Pending part means they have a lot of submissions coming in now and it is waiting to be sent in. They just came out with new IPS definitions which may be causing a lot of activity. It's just a statistical submission. It's waiting to be submitted to the norton community watch. This is how Norton can adjust the IPS defintions if they need to be adjusted.

Its sending the submission because it sees something fishy, right? Better to be safe than sorry, right?

 

It sees a lot of code that represents a known attack. Its just not sure. Am I understanding this wrong?

Hello MarcHatzi

 


The Norton Community Watch category in Security History provides details about the security and the application data that were submitted to Symantec. Symantec analyzes the data to determine new threats and their sources. This analysis helps Symantec to provide the solutions that identify the new threats and risks more efficiently.


This has been copied from the Help Section for Norton Community Watch. Perhaps this will explain it to you better.

I just did a test.

 

On one of my favorite sites (OUFANS.com, its a oklahoma football site) it has a rolling ad. I went to the site and did this

 

1) restarted the computer

2) went to the site and got as IPS submission from a url spd.pointroll.com

3) closed IE down.

4) Clicked back on it and the adds were blocked.

5) closed IE 5 times and look at the site 5 times and the block where the ads normally are was blank.

6) restarted the computer

7) went back to the oufans site and got the ips submission again. I could see the ads scrolling so I backed out of IE and clicked on it again.

8) went back to the site and the ads were blocked.

 

so it looks like Nortons is blocking the ads once it sends the ips submission.

I went to the url listed as the attacked and its a advertising site for the internet.

 

 

Just went to another site with a rolling ad and got another IPS submission.

 

again, pointroll.com

Hello MarcHatzi

 

You can block that site in IE options. You can also add that site into your ad blocker in IE so that it is blocked. You can also delete your cookies and temp files.

floplot,

 

Thank you for taking the time to respond.

 

It looks like Nortons fine tuned the IPS in its latest update and I no longer get the submissions.

 

Again, thank you for your help sir.

 

Marc

Hello MarcHatzi

 

You're welcome. I'm glad that they fine tuned that one also as I was getting a couple of them also. I think this is the first time I been called a sir in this Forum.    :womantongue::womansurprised:

 

 

If you consider your problem as being solved, would you please mark the post that solved your problem so that others may know the thread has been solved and will be able to find the solution quickly. Thanks.