topic Re: Bypassing application control on PAN-OS in General Topics

Bypassing application control on PAN-OS

Retired Member — Fri, 19 Oct 2012 13:39:51 GMT

I stumbled upon a blog entry (http://www.what2code.net/?p=100) describing how to, sadly, bypass application control on Palo Alto Networks boxes.

Author does not provide the source code, but I believe the method is not the work of his imagination.

Any comment on this by PAN Team? Any possible cure for the virus?

Re: Bypassing application control on PAN-OS

mikand — Fri, 19 Oct 2012 18:51:05 GMT

While we are waiting for someone from PA to show up on friday evening I have posted a reply in the other thread with similar question

Re: Bypassing application control on PAN-OS

Retired Member — Tue, 30 Oct 2012 19:30:47 GMT

We do not feel that using client-server collusion by starting the connection as a permitted application and switching to another is genuine or valid test. The scheme devised in the test assumes both the client and server are already under the control of the attacker. We don't know of any real-world clients or servers that can talk HTTP initially and then switch to SSH. Our app-ID has coverage for many evasive real-world tunneling applications and we continue to add coverage for more as we discover them. In this instance, we are working to enhance checks in our HTTP decoder to identify this scheme and set the session to be unknown-tcp. We are targeting to make the fix available in the next 1-2 content updates.

Re: Bypassing application control on PAN-OS

mikand — Tue, 30 Oct 2012 21:45:46 GMT

I belive this is valid because its these methods that malware will use to break out of the internal network in order to phone home various of stuff it can get its hand on.

Compromised client: checked (usually its a matter of "when" not "if").

Compromised server: checked (just look at all botnets where most uses compromised servers to act as C&C).

and suddently we have a situation where both the client AND the server is compromised and can run whatever protocol they wish (specially when you take networks such as the internet into account).