Year: 2017

Our Palo Alto Networks Education and Certification team is pleased to announce the availability of the new Palo Alto Networks Certified Security Engineer (PCNSE) exam. This new role-based certification replaces the previous technology versioned certifications to better prepare you for your career leveraging Palo Alto Networks Next Generation Security platform.

The exam covers topics related to PAN-OS 8.0 software, Panorama, GlobalProtect, and other aspects of the Palo Alto Networks network security platform that a firewall administrator needs to know to design, install, configure, maintain and troubleshoot the vast majority of Palo Alto Networks implementations. (Note: This exam does not cover Aperture, Traps or AutoFocus.)

The PCNSE Study Guide and Blueprint supplies an overview of the exam and explains its scope as well as how a candidate can register and prepare for it. The study guide also shows the objectives covered by the exam, and provides sample questions and resources for candidate preparation.

Why Certification From Palo Alto Networks Matters

A gap in cybersecurity skills and the needs of the industry rank among the top issues facing organizations today. As the fastest-growing security vendor, we realize that training and certifying skilled resources helps our customers tackle their cybersecurity goals confidently.

The majority of Palo Alto Networks customers are moving from legacy technologies to our Next-Generation Security Platform to consume the most advanced features and ensure maximum protection against digital attacks. This transformation to network, endpoint and cloud protection is best achieved with properly skilled resources. The certification program from Palo Alto Networks validates that credentialed individuals possess the Next-Generation Security Platform knowledge necessary to prevent successful cyberattacks and safely enable applications.

There are several other notable benefits of certification from Palo Alto Networks, including having:

• Projects done right the first time
• Consistency of implementation
• Improved team performance and productivity
• Faster identification, investigation and remediation of issues

Palo Alto Networks certification benefits not only organizations but also the individuals by showcasing their knowledge of the Next-Generation Security Platform. It provides an immediate improvement to their professional profile and, for those with their sights on the future, aligns them with the fastest-growing security company.

For more information, visit the PCNSE Certification page or join us for CERT FEST, our upcoming PCNSE exam preparation workshop.

[Palo Alto Networks Research Center]

This Unit 42 blog post provides an update on the threat situation surrounding the Bad Rabbit ransomware attacks.

 

Attack Overview

Bad Rabbit is a ransomware attack that, at the time of this writing, appears to primarily be affecting countries in Eastern Europe. While not spreading as widely as the Petya/NotPetya attacks, reports indicate that where Bad Rabbit has hit, it has caused severe disruption. The Ukrainian CERT has issued an alert on Bad Rabbit.

As detailed below, Bad Rabbit gains initial entry by posing as an Adobe Flash update. Once inside a network it spreads by harvesting credentials with the Mimikatz tool as well as using hard coded credentials.

Bad Rabbit is similar to Petya/NotPetya insofar as it encrypts the entire disk.

We are not aware of any reports of successful recovery after paying the ransom.

Because the initial attack vector is through bogus updates, Bad Rabbit attacks can be prevented by only getting Adobe Flash updates from the Adobe web site.

 

Reconnaissance

This attack does not appear to be targeted. Therefore, there appears to be little reconnaissance as part of this attack.

 

Delivery/Exploitation

According to ESET, the initial infection vector for Bad Rabbit is through a fake Adobe Flash update that is offered up from compromised websites. Proofpoint researcher Darien Huss‏ has reported this fake update was hosted at 1dnscontrol[.]com. Reports differ on whether this is delivered through social engineering that convinces the user to install the fake update or if it is delivered silently through unpatched vulnerabilities (i.e. “drive-by” installs).

 

Lateral Movement

Once inside a network, Bad Rabbit propagates itself to other systems. Reports indicate that it harvests credentials using Mimikatz and Maarten van Dantzig reports it also uses common hardcoded credentials to spread.

 

Command and Control (C2)

At this time, we have no information on command and control for Bad Rabbit.

 

Conclusion

Bad Rabbit is not as widespread of an attack as Petya/NotPetya but is causing severe disruptions where it is occurring. It is similar to Petya/NotPetya in terms of the impact of a successful attack. However, it is a different attack with different malware.

We will update this blog with new information as it becomes available.

For information on how Palo Alto Networks products prevent Bad Rabbit, please see our Palo Alto Networks Protections Against Bad Rabbit Ransomware Attacks blog post.

As always if you have any questions, please come to the Threat & Vulnerability Discussions on our Live Community.

 

Version Summary

October 24, 2017 2:30 p.m. PT

• Initial Publication

[Palo Alto Networks Research Center]