topic Re: Wildfire - Time required to block known malware in General Topics

Wildfire - Time required to block known malware

apackard — Mon, 18 Feb 2013 17:24:31 GMT

Using the 'free' Wildfire service, does anyone know how long should I expect the delay to be before downloads marked as malware are blocked subsequently?

For example, today we had a download ("pdf_delta_ticket.scr" below) that was logged as upload-skip which to my knowledge means that it has been seen before by this device. As the last previous upload-success was ~6 days previously (and as it was a DLL it almost certainly wasn't the original download) this seems to suggest that the time taken is more than a few days (we download and install AV updates daily).

Rgds

Re: Wildfire - Time required to block known malware

sraghunandan — Mon, 18 Feb 2013 17:44:02 GMT

Whenever a new file is sent to wildfire it is analyzed for various malicious behaviors. You can login to your wildfire portal to check the status of your files i.e only if it is found to be malicious an av signature is created and released. So have you had a chance to look at your wildfire portal @ https://wildfire.paloaltonetworks.com/Wildfire .

Also refer the following documents:-

WildFire Decision Flow

How to Configure Wildfire

Thanks,

Subijith Raghunandan.

Re: Wildfire - Time required to block known malware

apackard — Mon, 18 Feb 2013 17:56:32 GMT

Yes - I've checked the portal and it is VERY malicious (turning off IE phishing protection, disabling the firewall etc)!

While I understand that some malware is polymorphic and will change it's binary fingerprint, the fact that this was a skipped upload means that it must have been seen before in it's current "guise" and I can only assume that it would have looked just as malicious previously (I can;t see why not).

As we haven't had a upload for 4 days (and the most likely EXE upload was at least 12 days ago) that seems to suggest that no AV signature has been released in the previous 2 weeks that should have triggered on the re-download (or the signature released failed to match it properly?).

Rgds

Re: Wildfire - Time required to block known malware

apackard — Mon, 18 Feb 2013 18:09:46 GMT

However - having checked the flowchart in the referenced documents (thanks) I note that the hash check is actually performed in the Palo cloud, not on the PA device - so I guess this means that it is not dependent on the previous upload from our network.

Rgds