Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Palo Alto Networks PAN-OS Zero-Day Exploitation

volexity.com

Post reply on HN
Print view View original

51–60 of 66 posts

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#51

Post by eemil »

numpad0 wrote: post #10

I understand that these products has market demands from paranoid but not IP networking related businesses, but I never quite understood the fundamental basic premise of Palo Alto, F5 Networks, Fortinet, etc. brands of "MITM TLS firewall" products. These firewall boxes are on-prem white hat Mallory, reverse-reverse-proxying all TLS traffic. And of course the Linux stack it uses has tons of RCEs and misconfigurations.…

Modern L7 firewalls do a lot more than just MITM, and they can do it without MITM.

Take a look at Palo Alto's applipedia[1], it has 4419 protocols/services that you can detect and write security policy for without decrypting anything.

One example, last week our firewall blocked a suspicious (but but in this case legitimate) site using DNS sinkholing, because the domain seemed suspicious (uncommon TLD + recently registered domain).

[1]: https://applipedia.paloaltonetworks.com/

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#52

Post by cduzz »

neilv wrote: post #28
WirelessGigabit wrote: post #12

Earlier quoted context omitted.

Company I worked at turned on MITM TLS for everything. Suddenly a lot of stuff stopped working, because not every piece of software on my machine uses the OS's certificate store. For example Docker containers who then curl to set up stuff.

One company had a related (but less defensible) decision, coming down from the top, which broke CI runners and other things, and the poor overworked Git&CI infra lead was trying to work around it. They asked me to be a Git reviewer for their big workaround, and I found around a dozen new vulnerabilities and future build-breaking defects that the workaround introduced. I also told them that it's unreasonable for this…

I get that this sort of MITM often breaks CI pipes, but working with this shouldn't be anything more than a chunk of work involving stuff you ought to be doing already, including:

1. put all assets into infrastructure you control, allow pulling only from that infrastructure, no exceptions.

2. understand your containers enough to be able to modify and manage their trusted CA / TLS chains.

You really ought to be in a position to manage your supply chain and you really ought to be in a position to manage what your containers trust. Certainly more work and inconvenient, and maybe not practical everywhere, but worth doing even independently of a middleware box, at least once you get to some level of "in production for reals"

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#53

Post by dcow »

chelmzy wrote: post #42
dcow wrote: post #32

Earlier quoted context omitted.

Honest question: have you ever seen a corporate TLS middleware box stop an active threat? And I don’t mean drive-by crap like port scanning for sshd…

Its typically used for detecting malware, detecting data loss prevention, or forensics. "Drive by crap like port scanning for sshd" isn't even relevant to why companies mitm SSL. And yes I see it detect but not stop active threats on a daily basis.

These tools typically claim to block or catch stupidly high number of threats per unit time. And they usually bucket the drive-by stuff as a threat to achieve this narrative. I agree it’s hogwash.

So you’re essentially admitting that these TLS boxes are more about controlling employees and “data loss prevention” than actually preventing real threats and doing honest security. Got it.

https://honest.security

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#54

Post by FuriouslyAdrift »

mistrial9 wrote: post #36
unethical_ban wrote: post #13

Earlier quoted context omitted.

The premise is that a business needs to know what kind of data is passing through its networks. SSL forward proxy (man in the middle) helps this by letting the firewall see contents of data, more thoroughly govern access to websites and subcomponents of websites, and so on. For example, with MITM enabled, a Palo firewall can grant access to the viewing of Youtube videos, but not the upload or commenting of them. It c…

> a business needs to know what kind of data is passing through its networks a business... without context this appears to be a "free" card for any amount of micromanagement or intra-company snooping.. locks on the cabinets with the cheap coffee in it.. that level of petty.. sure, there are larger objectives but the way this is said, there appear to be no checks and balances.. it could be like a fish-in-a-barrel snoo…

Companies have a legal and fiduciary duty wrt everything that goes on with their equipment and services.

Examples:

I was the regional IT director at an extremely large, French owned, financial organization that had a child pornography ring operating among a couple of employees and several outside entities. The investigation and apprehension involved the FBI.

At the same company: FINRA investigation into illegal insider trading at the commodities brokerage part of the company.

This stuff is going on all the time. Some of it involving law enforcement, national intelligence services (I have worked with fusion centers several times, too), and internal HR/legal.

You just don't know about it because you aren't in ops/secops/legal/hr/compliance.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#55

Post by FuriouslyAdrift »

spudlyo wrote: post #20

"Device telemetry collects data about your next-generation firewall or Panorama and shares it with Palo Alto Networks by uploading the data to Cortex Data Lake. This data is used to power telemetry apps, which are cloud-based applications that make it easy to monitor and manage your next-generation firewalls and Panoramas." This is an eyebrow raising feature, and one I hope that I would have had the foresight to disa…

Telemetry is pretty much the norm for XDR. The problem is all this stuff is cloud and not on-prem. Wazuh is great for on-prem, but the profiliferation of SaaS, etc., makes it extremely difficult to keep a handle on everything.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#57

Post by HeatrayEnjoyer »

bnjms wrote: post #45
aeyes wrote: post #2

> Q. Has my device been compromised by this vulnerability? > Customers are able to open a case in the Customer Support Portal (CSP) and upload a technical support file (TSF) to determine if their device logs match known indicators of compromise (IoC) for this vulnerability. They can't be serious...

You want them to share their IoC so the exploit authors can add to the exploit’s mitigations?

IoCs are always public

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#58

Post by spudlyo »

FuriouslyAdrift wrote: post #55
spudlyo wrote: post #20

"Device telemetry collects data about your next-generation firewall or Panorama and shares it with Palo Alto Networks by uploading the data to Cortex Data Lake. This data is used to power telemetry apps, which are cloud-based applications that make it easy to monitor and manage your next-generation firewalls and Panoramas." This is an eyebrow raising feature, and one I hope that I would have had the foresight to disa…

Telemetry is pretty much the norm for XDR. The problem is all this stuff is cloud and not on-prem. Wazuh is great for on-prem, but the profiliferation of SaaS, etc., makes it extremely difficult to keep a handle on everything.

My feeling is that Wazuh is of little use to anyone besides those aiming to please security auditors, for whom it provides file integrity monitoring and other 20th century best practices that predate our modern world of virtualized short-lived servers.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#59

Post by unethical_ban »

dcow wrote: post #53
chelmzy wrote: post #42

Earlier quoted context omitted.

Its typically used for detecting malware, detecting data loss prevention, or forensics. "Drive by crap like port scanning for sshd" isn't even relevant to why companies mitm SSL. And yes I see it detect but not stop active threats on a daily basis.

These tools typically claim to block or catch stupidly high number of threats per unit time. And they usually bucket the drive-by stuff as a threat to achieve this narrative. I agree it’s hogwash. So you’re essentially admitting that these TLS boxes are more about controlling employees and “data loss prevention” than actually preventing real threats and doing honest security. Got it. https://honest.security

>I agree it’s hogwash.

I think the parent commenter was pointing out that "MITM TLS box" has nothing to do with sshd scans. Not that MITM TLS boxes have no use.

Oh, and #4 on that "tenets of honest security" is an opinion not shared by all.

In the modern era of guest wifi and ubiquitous personal mobile devices, personal use on a work machine is not necessary or advisable. That said, in most places it is common to *not* decrypt websites related to health and government and banking.

Everything is about liability and protection of company data.

Re: Palo Alto Networks PAN-OS Zero-Day Exploitation

#60

Post by daghamm »

_23sd wrote: post #9

Global Protect is up there with Citrix Netscaler and Fortigate SSLVPN in the list of "secure" remote access products that no organization should be using without considering the fact that another easy RCE is going to come out roughly every 12 months and possibly lead to a ransomware incident.

Not the first widely exploited 0day in GlobalProtect. Can you really consider this a highly secure product?

https://nvd.nist.gov/vuln/search/results?form_type=Basic&res...

Post reply on HN