Endpoint Protection

Hello,

Means this Error "[SID 25821] web attack facebook fake survey 3 detected"

HI,

Check this artical

Web Attack: Facebook Fake Survey 3

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=25821

Check this blog

Social Scams
https://www-secure.symantec.com/connect/blogs/social-scams

Check this thread

http://www.symantec.com/connect/forums/web-attack-facebook-fake-survey-3

I will check attach URL and update you.

It means your IPS has blocked an attack attempt. It should be doing its job. If you open your security log, more info will be there

Hello,

Web Attack: Facebook Fake Survey 3 exploits Microsoft Internet Explorer CVE-2012-1876 Col Element Remote Code Execution Vulnerability

http://www.securityfocus.com/bid/53848/info

I would recommend you to -

1) Make sure ALL Computers are installed with Symantec EP with latest / updated with virus defintions.

2) Install ALL Latest Microsoft Secuirty Patches / Sevice Packs on ALL machines.

3) Make sure ALL the client machines are using the Latest Vendor Patches installed.

If the IPS signture indicates that the malicious traffic was safely blocked and your computers are fully patched, then you should be OK.  Definitely do keep your defences up and stay aware.  Social networking is great, but as with most things there are scams and dangers.  Her is some good reading from Symantec and Facebook security teams:

Social Scams

https://www-secure.symantec.com/connect/blogs/social-scams

Phishers' Fake Security App for Facebook

https://www-secure.symantec.com/connect/blogs/phishers-fake-security-app-facebook

Here's a direct link to that whitepaper:

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/scams_and_spam_to_av

Hope that helps!!

Hi

Please confirm that systems are patched with required microsoft patches and latest definitions update.

Regards

Hi Kiran,

Go through the Link below and you will understand what it is and why it is important to be blocked.

http://www.symantec.com/business/support/index?page=content&id=TECH152794&actp=search&viewlocale=en_US&searchid=1361448673908