Palo Alto Networks PAN-OS Zero-Day Exploitation • Hacker News Board

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#11

Post by p_l » Fri, Apr 12, 2024, 3:56 PM UTC

numpad0 wrote: post #10

I understand that these products has market demands from paranoid but not IP networking related businesses, but I never quite understood the fundamental basic premise of Palo Alto, F5 Networks, Fortinet, etc. brands of "MITM TLS firewall" products. These firewall boxes are on-prem white hat Mallory, reverse-reverse-proxying all TLS traffic. And of course the Linux stack it uses has tons of RCEs and misconfigurations.…

In case of Palo Alto Networks TLS interception wasn't the only, or even main, use in many places.

Among reasons one might have seen them was centralised control plane, multipoint VPNs, yes deep-packet inspection (including for simply checking if the expected protocol was running on given traffic), they could be also simply used as pretty advanced router+firewall setup.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#12

Post by WirelessGigabit » Fri, Apr 12, 2024, 4:27 PM UTC

numpad0 wrote: post #10

I understand that these products has market demands from paranoid but not IP networking related businesses, but I never quite understood the fundamental basic premise of Palo Alto, F5 Networks, Fortinet, etc. brands of "MITM TLS firewall" products. These firewall boxes are on-prem white hat Mallory, reverse-reverse-proxying all TLS traffic. And of course the Linux stack it uses has tons of RCEs and misconfigurations.…

Company I worked at turned on MITM TLS for everything.

Suddenly a lot of stuff stopped working, because not every piece of software on my machine uses the OS's certificate store.

For example Docker containers who then curl to set up stuff.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#13

Post by unethical_ban » Fri, Apr 12, 2024, 4:41 PM UTC

numpad0 wrote: post #10

I understand that these products has market demands from paranoid but not IP networking related businesses, but I never quite understood the fundamental basic premise of Palo Alto, F5 Networks, Fortinet, etc. brands of "MITM TLS firewall" products. These firewall boxes are on-prem white hat Mallory, reverse-reverse-proxying all TLS traffic. And of course the Linux stack it uses has tons of RCEs and misconfigurations.…

The premise is that a business needs to know what kind of data is passing through its networks. SSL forward proxy (man in the middle) helps this by letting the firewall see contents of data, more thoroughly govern access to websites and subcomponents of websites, and so on. For example, with MITM enabled, a Palo firewall can grant access to the viewing of Youtube videos, but not the upload or commenting of them. It can also scan files for malware, do analysis on shady looking javascript, and run DLP and credential checks to make sure no one is accidentally sending sensitive data to the wrong site.

The SSL forward proxy feature of Palos has a number of things that preserve the security of TLS connections, such as requiring a minimum TLS version, "passing through" cert errors like expiration or bad CN, and so on.

I've worked with PA firewalls for a while.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#14

Post by ok123456 » Fri, Apr 12, 2024, 4:42 PM UTC

vladvasiliu wrote: post #7

tatersolid wrote: post #4

Earlier quoted context omitted.

PaloAlto devices ARE “Linux Firewalls” https://live.paloaltonetworks.com/t5/general-topics/how-to-a...

They probably mean some Linux distro with no crapware on top. Seeing how this exploit seems to be PaltoAlto-specific stuff built on top of the basic OS, GP's approach sounds sensible enough.

Yes. This is what I meant. A GNU/Linux iptables2 firewall.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#15

Post by unethical_ban » Fri, Apr 12, 2024, 6:05 PM UTC

WirelessGigabit wrote: post #12

numpad0 wrote: post #10

I understand that these products has market demands from paranoid but not IP networking related businesses, but I never quite understood the fundamental basic premise of Palo Alto, F5 Networks, Fortinet, etc. brands of "MITM TLS firewall" products. These firewall boxes are on-prem white hat Mallory, reverse-reverse-proxying all TLS traffic. And of course the Linux stack it uses has tons of RCEs and misconfigurations.…

Company I worked at turned on MITM TLS for everything. Suddenly a lot of stuff stopped working, because not every piece of software on my machine uses the OS's certificate store. For example Docker containers who then curl to set up stuff.

Yeah, it needs to be rolled out and tested a lot. And not all traffic should be decrypted, namely banking and health.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#16

Post by sebazzz » Fri, Apr 12, 2024, 6:10 PM UTC

WirelessGigabit wrote: post #12

numpad0 wrote: post #10

I understand that these products has market demands from paranoid but not IP networking related businesses, but I never quite understood the fundamental basic premise of Palo Alto, F5 Networks, Fortinet, etc. brands of "MITM TLS firewall" products. These firewall boxes are on-prem white hat Mallory, reverse-reverse-proxying all TLS traffic. And of course the Linux stack it uses has tons of RCEs and misconfigurations.…

Company I worked at turned on MITM TLS for everything. Suddenly a lot of stuff stopped working, because not every piece of software on my machine uses the OS's certificate store. For example Docker containers who then curl to set up stuff.

I hate ZScaler with a passion.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#17

Post by sky_nox » Fri, Apr 12, 2024, 7:57 PM UTC

[flagged]

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#18

Post by wufocaculura » Fri, Apr 12, 2024, 8:19 PM UTC

From official advisory at https://security.paloaltonetworks.com/CVE-2024-3400, I smiled to that one:

"If you are unable to apply the Threat Prevention based mitigation at this time, you can still mitigate the impact of this vulnerability by temporarily disabling device telemetry"

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#19

Post by Sohcahtoa82 » Fri, Apr 12, 2024, 9:49 PM UTC

sebazzz wrote: post #16

WirelessGigabit wrote: post #12

Earlier quoted context omitted.

Company I worked at turned on MITM TLS for everything. Suddenly a lot of stuff stopped working, because not every piece of software on my machine uses the OS's certificate store. For example Docker containers who then curl to set up stuff.

I hate ZScaler with a passion.

At my last job, my CISO made the company trial ZScaler. When it caused tons of problems for Engineering, he cancelled the trial, then tried out CloudFlare's MitM proxy, which of course had the same problems.

I had to talk to him and say look, what you're trying to do isn't possible without breaking things. It's not a limitation of the products, it's a limitation of the underlying security that you're trying to bypass, and you're making security WORSE, not BETTER.

He wanted to log every employee's Internet traffic so that he could determine if someone was leaking company data, such as source code, customer data, etc. I said that there's nothing you can do to stop that, and even if someone knows their traffic is being monitored, it's easy to bypass by just adding a second layer of encryption.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#20

Post by spudlyo » Fri, Apr 12, 2024, 10:30 PM UTC

"Device telemetry collects data about your next-generation firewall or Panorama and shares it with Palo Alto Networks by uploading the data to Cortex Data Lake. This data is used to power telemetry apps, which are cloud-based applications that make it easy to monitor and manage your next-generation firewalls and Panoramas."

This is an eyebrow raising feature, and one I hope that I would have had the foresight to disable.