Could someone elaborate on the section which says:
All PAN-OS devices require a configuration change to detect even the most basic TCP stream segmentation evasions. The “Mismatched overlapping TCP segment” protection in the Zone Protection profile is not enabled by default, which allows attackers to bypass the device completely using TCP stream segmentation with overlapping data evasion techniques. NSS strongly recommends that this protection is always enabled – any PAN customer that has not checked this box is at extreme risk.
I've not come across this and would like to know if it's suggested to enable it?
I had thought about posting that same report in hopes of seeing / hearing other thoughts.
This video was also ... interesting to say the least.
Note: I understand this appears to be a CheckPoint smear channel, it's still interesting to see the vulnerability.
I have tried attack which is shown in previously mentioned video (Palo Alto Netowrks IPS evasion DEMO - NSS Labs - YouTube) and it was not successful over PA. It looks like PA (6.0.5, app&threat 459-2387) is blocking all segmented SMB traffic.
I have to add that all I tried was conficker attack using single "smb_seg" evasion as shown in video which was stopped using signature not normalization. I haven't ran Evader in Automatic Evasions mode for 12 hours as shown in video..
Strangely some messages from hshah and one from me disappeared in this thread.
Thanks for inputs. As I said PANW first gathers all fragemetns, IF any fragment is
missing or overlapping than it simply drops all fragments.
Then I wrote that it looks like PA is blocking ANY fragmented SMB traffic not just with missing or overlapping fragments.
That might be true.
Interesting, why would it block genuine fragments ?
My response (ask PA) is still here..
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!