About ReubenFarrelly

I'm seeing quite a lot of messages logged in the syslog output from my PA VM-100 running PAN-OS 10.0.0:   Aug 19 07:31:29 firewall-1 1,2020/08/19 07:31:29,007051000047085,SYSTEM,general,2560,2020/08/19 07:31:29,,general,,0,0,general,medium,"DNS signature lookup timed out",1461969,0x0,0,0,0,0,,firewall-1,0,0,1970-01-01T10:00:00.000+10:00 What exactly does "DNS signature lookup timed out" mean? My VM has two local DNS servers configured, which are functioning well and the PA VM has access to do direct external lookups as well if it needs to do so.  It is located on the end of a quiet 250/100M internet fibre connection here in Australia, so connectivity and congestion is not an issue.   The DNS Signature Lookup Timeout (ms) value is set to 300 - far far above what should be necessary. Can anyone explain the traffic flow that might cause this (do these DNS queries go direct, or via configured resolver, and over what transport) ?   If this is an error, how do I go about debugging it to find the root cause?   Thanks, Reuben ... View more

I've recently set up a new PA-100-VM and been closely analysing it along with all of the traffic that goes through it.  It is running 7.0.3 along with the latest updates to all definition files (updated nightly).   In the process of doing this I've determined that the PA is not picking up on a fairly common SMTP attack - that being the Cutwail SMTP auth brute force.  There is a bit more info about this here:    https://blog.avast.com/2013/06/25/15507/  https://serverfault.com/questions/667322/email-server-attack-from-telnet   A machine infected with this worm will attempt to brute force SMTP auth other random machines on the Internet.   The good thing is that all of the attempts involve a very characteristic SMTP EHLO of ylmf-pc.  So they are patently obvious to identify.   I've written a custom malware signature that detects this and IP blocks the offending hosts for the maximum 3600s (I would block for longer if this was possible).  This works well.  Lots of hits and no brute forcing anymore 😉   The questions I have are:   - Is there a way to submit this to Palo Alto so that this attack is picked up by the threat signatures without me having to write a custom vulnerability sig?  I can open a case but I would have thought there were easier ways than this to have this information fed into the system.   - Is there a reason this hasn't been already added?  This is a very common vulnerability by all accounts.  I haven't tried but I imagine the PA will pick up on the trojan exe's that this worm uses to transmit itself, but as a non-infected user I also want protection from other remote machines who have been exploited and I would expect the appliance would be protecting me from known brute force attacks.     ... View more