topic Re: Known Malware passing through PA to Client in General Topics

Known Malware passing through PA to Client

Bvance — Thu, 07 Jun 2012 19:43:59 GMT

Hello PAN,

Today I had a client get infected with the "Windows Privacy Module" Fake AV, This wasn't cought by either PAN OS or Trend Micro while a MalwareBytes scan found it and removed it no problem. Is there something more I can do to increase the odds of my PA SG in catching these? I do keep th AV software up to date along with the PAN OS and I do have the Security profile on all ingress traffic set to block.

Thanks,

Re: Known Malware passing through PA to Client

UhMayYeah — Thu, 07 Jun 2012 19:55:02 GMT

This looks like a false-negative bypassing PAN-OS firewall.Please open a support case providing following info.

(1) samples pcaps
(2) Reference URL /Links etc. associated with the Virus.

Refer : https://live.paloaltonetworks.com/docs/DOC-1283 for future references.

Thanks ,

Ameya

Re: Known Malware passing through PA to Client

mikand — Thu, 07 Jun 2012 20:39:10 GMT

As a sidenote you could also enable ssl decryption in order to be able to inspect also https traffic. Along with (if possible) block .exe and other filetypes from being downloadable by the clients. And to top it off you could enable url categorization and block follow categories:

Keyloggers and Monitoring

Malware sites

Spyware and Adware

Re: Known Malware passing through PA to Client

Bvance — Fri, 08 Jun 2012 12:21:53 GMT

Thanks, I'll give these a shot.

Re: Known Malware passing through PA to Client

Bvance — Fri, 08 Jun 2012 14:32:49 GMT

From what I have been reading on inbound SSL decryption it looks like we would have to have our own Microsoft certificate server. Is this correct?

Thanks,

Re: Known Malware passing through PA to Client

mikand — Fri, 08 Jun 2012 18:27:57 GMT

Thats incorrect.

You need to install a selfsigned CA-cert (along with its private key) in your PA device and then install the public key as "trusted CA" in your clients browsers (if you have an AD you can push this CA public key through GPO).

This CA-cert (for ssl-termination) can be created by using the openssl binary.

However - depending on your company regulations regarding certs and stuff and specially if you already have a PKI infrastructure then I would use the PKI environment to create either a new CA or an intermediate CA to be used in your PA.