Palo Alto software turned evil by XDR researcher, perfect malware

TLDR:

• Security researcher turns Palo Alto Networks’ XDR software into powerful malware, granting full control over targeted machines.
• Exploit allowed for deployment of reverse shell and ransomware, highlighting potential vulnerabilities in XDR solutions.

Article Summary:

A security researcher, Shmuel Cohen, demonstrated at Black Hat Asia how he reverse-engineered and weaponized Palo Alto Networks’ XDR software to deploy malware like a malicious multitool. By manipulating the program’s defenses and utilizing a hard link to access sensitive files, Cohen was able to take full control of a targeted machine, even deploying ransomware undetected.

The XDR platform’s immense power and access privileges make it a valuable target for attackers, who could potentially exploit similar vulnerabilities in other XDR solutions. While Palo Alto Networks addressed most of the weaknesses identified by Cohen, they chose not to encrypt Cortex’s Lua files, which could still be accessed by skilled attackers.

Cohen’s research highlights the risks associated with using XDR solutions, as well as the potential for these powerful security tools to be weaponized by cybercriminals with the right knowledge and skills.