jdorfman/fortinet.md

## fortinet.md

      
    Raw
  

              fortinet.md
            
          
    Customer:

Are you aware that Fortinet identifies your script as malware/virus? I’m trying to get them to remove the falsepositive but it’s taking forever and I’m getting bombarded with alerts from my firewall:
Message meets Alert condition

Virus/Worm detected: JS/Nemucod.280A!tr Protocol: HTTP Source IP: 10.50.30.71 Destination IP: 108.161.188.218 Email Address From: Email Address To: http://www.fortinet.com/ve?vn=JS%2FNemucod.280A%21tr
date=2016-07-22 time=14:10:23 devname=MTL-VG-FW1 devid=FGT5HD3914801928 logid=0211008192 type=utm subtype=virus eventtype=infected level=warning vd="root" msg="File is infected." action=blocked service=HTTP sessionid=430261293 srcip=10.50.30.71 dstip=108.161.188.218 srcport=50183 dstport=80 srcintf="port10" dstintf="port11" policyid=1 proto=6 direction=incoming filename="bootstrap.min.js" quarskip=No-skip virus="JS/Nemucod.280A!tr" dtype="Virus" ref="http://www.fortinet.com/ve?vn=JS%2FNemucod.280A%21tr" virusid=7076988 url="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" profile="Lightspped AntiVirus basic scan" user="" agent="Mozilla/5.0" analyticscksum="2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a" analyticssubmit=false crscore=50 crlevel=critical

This is definitely a false positive by Fortinet.   How I tested:
Downloaded Bootstrap 3.3.6 directly from GitHub:

https://github.com/twbs/bootstrap/releases/download/v3.3.6/bootstrap-3.3.6-dist.zip
Unzipped it and ran:

$ cat bootstrap.min.js | sha384
$ 0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS SHA Hash

$ sri384 http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js
$ 0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS SHA Hash
Hashing Aliases:

alias sha384="openssl dgst -sha384 -binary | openssl base64"
sri384() { hash=`curl -s $1 |sha384`; echo sha384-$hash;}