Conversation

Notices

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Wednesday, 20-Nov-2024 02:38:19 JST Will Dormann

   How does one prove that they're authenticated to the PAN-OS security product, one might wonder.

   Simple.

   You provide a "X-PAN-AUTHCHECK: off" HTTP header.

   CVE-2024-0012, folks.
   https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 20-Nov-2024 02:38:18 JST Kevin Beaumont

     in reply to

     @wdormann an interesting Palo Alto thing is they're by far the most intrusive firewall vendor in terms of traffic - you build rules using app IDs rather than ports, it auto detects traffic, MITM TLS etc. It's really cool. Also... just how secure is that? Really?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 20-Nov-2024 06:20:56 JST Kevin Beaumont

     in reply to

     • Matt Organ

     @Slater450413 @wdormann yeah, the point was more it uses deep packet inspection for everything - relies on absolutely rock solid security to process everything.

   • Embed this notice
     Matt Organ (slater450413@infosec.exchange)'s status on Wednesday, 20-Nov-2024 06:20:57 JST Matt Organ

     in reply to

     • Kevin Beaumont

     @GossiTheDog @wdormann you can do rules using just ports, it's just not how they recommend you do it. I've had to do that a couple of places when the false positive rate became too high (chopping TLS connections at random) when new signature patterns dropped.