Bypassing application control on PAN-OS

[ACieszkowski]

I stumbled upon a blog entry (http://www.what2code.net/?p=100) describing how to, sadly, bypass application control on Palo Alto Networks boxes.

Author does not provide the source code, but I believe the method is not the work of his imagination.

Any comment on this by PAN Team? Any possible cure for the virus?

[mikand]

While we are waiting for someone from PA to show up on friday evening I have posted a reply in the other thread with similar question

[Retired Member]

We do not feel that using client-server collusion by starting the connection as a permitted application and switching to another is genuine or valid test. The scheme devised in the test assumes both the client and server are already under the control of the attacker. We don't know of any real-world clients or servers that can talk HTTP initially and then switch to SSH. Our app-ID has coverage for many evasive real-world tunneling applications and we continue to add coverage for more as we discover them. In this instance, we are working to enhance checks in our HTTP decoder to identify this scheme and set the session to be unknown-tcp. We are targeting to make the fix available in the next 1-2 content updates.

[mikand]

I belive this is valid because its these methods that malware will use to break out of the internal network in order to phone home various of stuff it can get its hand on.

Compromised client: checked (usually its a matter of "when" not "if").

Compromised server: checked (just look at all botnets where most uses compromised servers to act as C&C).

and suddently we have a situation where both the client AND the server is compromised and can run whatever protocol they wish (specially when you take networks such as the internet into account).