Palo Alto Networks Security Bypass

A demonstration of how to bypass application identification on Palo Alto Networks firewalls by exploiting caching shortcuts.

Step by Step Howto can be found here: goo.gl/KWLmI Palo Alto Networks touts the performance of their security gateway. But what they fail to mention is that the performance is achieved at the expense of security. In their attempt to deliver performance with APP-ID and their application control gateway, the PAN architecture jeopardizes security and leaves customers very exposed to attacks by the actions of malicious code, bots and people. Why does this happen? It is because PAN is using caching and other shortcuts to achieve higher performance. What happens to security when they do this? Application caching: PAN boosts performance by assuming that once a connection is established, they can stop inspection and rely on the cache, allowing acceleration of security. But unfortunately this also allows an attacker to bypass application identification by substituting a different application that is supposed to be blocked. Instead the new application is allowed and the attacker can capitalize on the hole in security to launch a successful attack. Regarding PAN's real performance, it actually diminishes quickly when strong security is desired. PAN forces an organization to make a tough tradeoff between performance and security. If security is chosen, then the customer will experience degradation in PAN's promised performance. So there's a choice to make with PAN, security or performance?