Latest DDOS attack related issue on Palo alto

FarhanKoujalgi — Wed, 08 Sep 2021 06:42:32 GMT

Hey guys one of my client having a concern about the security patch. he has PA-820 PA and PA-220. The New DDOS attack is there ID is CIAD-2021-0030

https://clicktime.symantec.com/3QdtY9QLh9kb4B5ny33Z2KD7Vc?u=https%3A%2F%2Fwww.cert-in.org.in%2F

Please check the Palo alto firewall is capable to handle this attack. is Palo alto have this security patch. I also mention the details about attack

Severity Rating: High

Description

A potential new method of DDoS attack has been identified that exploit a

loophole in the security middle boxes such as Intrusion Prevention Systems

(IPS), NextGen Firewalls, Network Address Translators (NATs) and Load

balancers etc.

The attack is carried out by sending a specially crafted sequence of

packets to misconfigured security middle boxes deceiving it into believing

a 3-way handshake is completed thus allowing TCP communication. The

attacker sends an HTTP request for a website likely to be blocked at the

security device, spoofing the IP Address of the victim, to which the

security device responds with a large HTML blocking notification page which

results in amplification effect. It is reported that the attacker can

achieve an amplification factor up to 100,000,000.

II. Measures to be adopted to protect against DDoS attacks.

1. Measures for detection of attacks:

Understand your current environment and have a baseline of the daily

volume, type and performance of network traffic.

Enable adequate logging mechanisms at perimeter, server, system level and

review the logs at frequent intervals.

Continuously monitor the network activities & server logs to detect and

mitigate suspicious and malicious activities in your network. Review the

traffic patterns and logs of perimeter devices to detect anomalies in

traffic, network level floods(TCP, UDP, SYN, etc.) and application floods

(HTTP GET) etc.

Preserve all logs indicating type of attack and attack sources.

2. Protection measures:

Thoroughly scan the network and online applications and plug any existing

vulnerability in the network devices, operating systems, server software

and application software and apply latest patches/updates as applicable.

Employ defense-in-depth strategies: emphasize multiple, overlapping and

mutually supportive defensive systems to guard against single point

failures in any specific technology and protection method.

Deploy appropriate Intrusion/DDoS Prevention System capable of detecting

and mitigating DDoS attacks. Ensure that Intrusion/DDoS Prevention System

contain signatures to detect the attacks launched from common attack tools.

Sudden surge in inbound traffic to any critical server or services, such as

ICMP floods, UDP/TCP flood etc. could be due to DDoS attacks. If such

attacks are observed, implement appropriate response measures in

coordination with Internet Service Provider (ISP).

Identify and block the attack sources at Router/Packet filtering

device/DDoS prevention solutions. Disable non-essential ports/services.

To counter attacks on applications, check the integrity of critical

application files periodically and in case of suspicion of attack restore

applications and content from trusted backups.

Maintain list of contacts of ISPs, vendors of network and security devices

and contact them as appropriate.

In case your SLA with ISP includes DDoS mitigation services instruct your

staff about the requirements to be sent to ISP.

Have a Business Continuity Plan and Disaster Recovery Plan ready for

activation in case of emergency.

topic Latest DDOS attack related issue on Palo alto in Advanced Threat Prevention Discussions

Latest DDOS attack related issue on Palo alto