PA Bypass Question - McAfee Evader

Demast — Tue, 08 Dec 2015 14:08:24 GMT

Does anyone have any information on the latest posted PA bypass? The youtube video shows some of the FW features being bypassed using McAfee Evader. It appears to require an IP of the firewall to execute - the example also shows most of the evasions relating to protocols not likely to be exposed over the firewall (NetBIOS, RPC, SMB) so I'm not sure how broadly this applies or how bad it is.

666 different ways to bypass palo alto networks in 6 minutes

Published on Nov 30, 2015
full log file can be found http://goo.gl/WR3VkJ
full config file http://pastebin.com/PXARPh2a

It seems pretty bad, and the video claims "This cannot be resolved by a patch or a signature as the single-pass architecture is fundamentally flawed."

We are opening a ticket on this to find out more.

Re: PA Bypass Question - McAfee Evader

Demast — Tue, 08 Dec 2015 14:21:59 GMT

Fast response from PA supprt:

On November 30th, a video was posted by the owner of the NetSecVulns YouTube channel titled "666 different ways to bypass palo alto networks in 6 minutes”.

In the first video, posted Nov 30th, NetSecVulns sets up a lab with a Windows XP SP2 victim and the Stonesoft Evader tool configured to use the Conficker attack and a Palo Alto Networks Next-Generation Firewall in Layer 3 mode placed in between 2 endpoints. Great pains are made to show that our firewall is configured using our Best Practices configuration document. Once the Evader tool completes its run, the administrator shows that our firewall missed 666 evasion attempts.

In reality, NetSecVulns skipped step 4 in our Best Practices document: creation of an unknown application block rule. This can be verified in the video (at 2:20) where we see a single allow rule instead of the expected 2 rules with the first one dropping unknown applications. Later in the video, at 4:31 and 5:49, it shows the "threat logs”, carefully avoiding "traffic logs" where we would have seen unknown-tcp sessions allowed through.

After running this test in our own lab on PAN-OS 7.0.3, and correctly following the same Best Practices document, we verified that we block 100% of the 204,090 evasion attempts. Also note that this test is performed by our internal QA team for each PAN-OS major and minor feature release.

On Dec 3^rd, NetSecVulns posted a new video, correcting the "step 4" error. However once again they did not follow all steps in the Best Practices document, rendering the test inaccurate and misleading.

topic Re: PA Bypass Question - McAfee Evader in General Topics

PA Bypass Question - McAfee Evader

Re: PA Bypass Question - McAfee Evader