@mikand I get what you're saying but if you look at Black Hat ... https://www.blackhat.com/us-15/briefings.html#advanced-ic-reverse-engineering-techniques-in-depth-analysis-of-a-modern-smart-card
You can at least get a synopsis of what the presenter is going to address, my contention with this sole media play is there is nothing other than "OMG ... PAN haz vulnz"
No kidding...EVERY IT product is going to have it's security vulnerabilities. We don't know what Palo has done (if anything) to address what Troopers brought to their attention.
If Troopers would have released something even in the ballpark at least WE the "Community" could scour the CVEs for something related to what Troopers says is out there; but they didn't do that. So now we're left with baited breath needing to pay for this first hand knowledge.
--Edit--
Further... https://www.blackhat.com/us-15/briefings.html#certifi-gate-front-door-access-to-pwning-millions-of-androids
"
CERTIFI-GATE: FRONT-DOOR ACCESS TO PWNING MILLIONS OF ANDROIDS"
"These vulnerabilities allow an attacker to take advantage of unsecure apps certified by OEMs and carriers to gain unfettered access to any device, including screen scraping, key logging, private information exfiltration, back door app installation, and more. In this session, Lacoon researchers will walk through the technical root cause of these responsibly-disclosed vulnerabilities including hash collisions, IPC abuse and certificate forging which allow an attacker to grant their malware complete control of a victims device. We'll explain why these vulnerabilities are a serious problem that in some ways can't be completely eliminated, show how attackers exploit them, demonstrate an exploit against a live device, and provide remediation advice."
They don't tell you how to exploit the code but Black Hat at least lets the community knows WHAT the issue or vulnerability offers up. Troopers didn't do anything of the sort. So asking a technology provider to address "tell me everything you've done wrong" is kinda like pissing into the wind.
... View more
