topic Re: How to use Wildfire for Android APK in General Topics

How to use Wildfire for Android APK

emr_1 — Tue, 20 Aug 2013 05:34:38 GMT

I found following new press release:

Palo Alto Networks WildFire Protects Against Cyber Threats Targeting Android Smartphones and Tablets

I have PaloAlto device with Wildfire subscription.

The device is running on PANOS 5.0.6.

How can I use this new wildfire?

Does it mean I just change configuration of File Blocking to upload .apk files?

If someone knows, please help. Otherwise, I'll contact to my local SE.

Regards,

Emr

Re: How to use Wildfire for Android APK

HULK — Tue, 20 Aug 2013 07:17:56 GMT

Hi Emr,

You are correct,

Apk--- Android application package file

It is part of File Blocking Profiles. ( Objects > Security Profiles > File Blocking ) and add APK as Supported File Formats for File Blocking.

Thanks

Re: How to use Wildfire for Android APK

HULK — Tue, 20 Aug 2013 07:21:22 GMT

For reference, please follow below mentioned article,

https://live.paloaltonetworks.com/docs/DOC-4118 >>>>>>> Page 216

Hope it will help you.

Thanks

Re: How to use Wildfire for Android APK

harshanatarajan — Tue, 20 Aug 2013 08:02:19 GMT

Hello

If you are trying to understand how Wildfire works and its configuration then the below links will give you a good understanding of the wildfire configuration, testing and monitoring.

How to Configure Wildfire

Wildfire Configuration, Testing and Monitoring

How to Check the Connectivity to Wildfire and Upload Status of Files

Hope this helps.

Re: How to use Wildfire for Android APK

VinceM — Tue, 20 Aug 2013 09:20:41 GMT

Hi,

For me, today, upload apk to Wildfire is not supported yet.

For now you can allow or block apk but can't be more granular.

Hope help

Re: How to use Wildfire for Android APK

UhMayYeah — Tue, 20 Aug 2013 09:35:06 GMT

Please confirm this information with your SE on the availability of Wildfire for Android.

Re: How to use Wildfire for Android APK

emr_1 — Tue, 20 Aug 2013 12:20:38 GMT

Thank you for your replies, guys.

I tested with my PA device.

As VinceM says, I confirmed PA did not upload the APK file at this point.

I think this is new feature available from 6.0.

Re: How to use Wildfire for Android APK

goku123 — Tue, 20 Aug 2013 12:32:19 GMT

Just to help clarify:

APK signatures for Android malware are being provided in AV signature set (PAN-OS 5.0+ only)
Currently the signatures are being developed by leveraging internal android wildfire analysis environment and running Android software from popular stores through it to determine maliciousness.

However, PAN devices themselves do not currently have the ability to forward apk files to the cloud as VinceM observed.

Re: How to use Wildfire for Android APK

emr_1 — Tue, 20 Aug 2013 12:38:10 GMT

Hi achitwadgi,

I see.

It helps me to understand more clearly.

Thanks for the updates.