02-04-2013 11:25 AM
Hi,
I've recently had a client who's PAN appliance failed to pick up a Zero-Day piece of malware that found it's way into their network via email.
We have wildfire configured correctly and it transpires they are using opportunistic TLS on their mail relay, the spammer had send the infected attachement using TLS so the Palo Alto had no hope of actually seeing the content.
Oddly the application appears as SMTP rather than TLS, i'm guessing because the first couple of packeta would have a clear text EHLO amongst other items, identifying the App as SMTP, TLS happens a little later in the SMTP session.
So, I tried an inbound SSL inspection rule, which would work for TLSv1 (most commonly used for SMTP relays), but no luck, the PAN never notices the existence of the TLS in the session so doesnt try to decrypt.
Am I missing something or is this not possible right now?
It'll be a real shame if it's not as it's a gaping hole for APTs/Malware to creep through. Of course the first thing I did in this instance was to advise the client that they block all .EXE's via their SPAM filter, but would have been nice to catch it at the Palo...
Thanks for reading!
Dave
02-12-2013 09:44 AM
Wildfire is for detection, the anti-virus signatures are for blocking. When a malware file is uploaded to Wildfire, you get a report that it was a bad file and can take action as mentioned above. Signatures detected as malware by Wildfire will be added to the Anti-Virus subscription that is pulled down at least once a day by your PA Firewall.
So your statement that Wildfire will NEVER block a file is correct in a sense. But files uploaded to Wildfire are quickly added as signatures to the Anti-Virus system and can be pulled in to the firewall. If using 5.0 there is a subscription feature available that pulls down the AV every hour and can include signatures recently uncovered (even within the most recent hour in some cases).
Hope this helps!
Greg
12-07-2016 05:50 AM - edited 12-07-2016 05:51 AM
Hello All,
what about feature request to distinguish between tls and non tls SMTP traffic?
Is there something new in decryption of non https encrypted traffic in general?
It might be good reason to open new topic on this issue, but this is huge security gap if consider that almost three years passed since this topic.....
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!