why are more people not talking about this? 

It's not necessarily more, but the impact of the vulnerabilities seems to be higher...

I believe this is because we have more cybersecurity specialists than ever before, and there are many more devices and features that involve an internet connection

It's just you. Stop projecting.

It's not just you

@@31redorange08 not trying to project. i have been more interested in this topic lately, so idk if this was simply content algorithms (over)doing their job

like the robot bees in Black Mirror

Not a bad thing imo, better than them being found by bad actors first

AI tools are finding them.

@@ianvecmanis5642 lol not today, not today

@@ianvecmanis5642 from what i've seen the AI tools currently most of the time just point to pointless stuff and lead to clutter in bugtracker

@@ianvecmanis5642 Ain't no way.

🧠🧠 Ohio level IQ moment

brilliance

I think your sentence is reversed. It sounds like you meant to say "to prevent the need to enter my network to steal my card" ;)

@@MyAmazingUsername I didnt understand anything of that comment, can you please explain what he meant to say?

@@NachitenRemix Putting his credit card number as wifi name to save the hacker's time. 💀

thats where the NSA and Mossad get in through the backdoor

​@@yeetyeet7070 based noticer

telemetry is an opt-in feature for Palo Alto firewalls. But yeah, I share your concerns.

That’s why we make our own!

Asking the users to turn telemetry back on is the icing on the cake. Why would a company want to keep a feature enabled that 1. Isn’t useful to them, 2. Had previous vulnerabilities? It seems pretty dumb.

Telemetry is replacing snmp? Which have been around in network proucts forever

Telemetry...with root privilege

@@henryptung exactly! wtf! why?! Surely telemetry just opens a port (with only sending allowed) -> send packet -> close port. Why can it even BE injected? doesn't that imply a 2-way communication? if so, why is telemetry process expecting to receive anything? receiving data is literally the opposite of its purpose.

I'm afraid they're probably discovering new exploits faster than their existing ones are getting fixed.

All kinds of backdoors being discovered.

it's for a feature called AiOps to do best practice assessments and collect system utilization of many firewalls on a cloud based platform

Just wait for next year, you haven`t seen anything yet ^^

I say that every year

No because direct circumvention is an oxymoron

Putting this everywhere since the video is a few days old. GlobalProtect is a, really annoying, VPN. Meaning the firewall itself is a server with a port open to the internet.

A painful VPN at that. The worst part is I'm pretty sure, for some companies, the second choice from GlobalProtect is to use the NetScaler boxes...

I did the same thing by switching to Arch Linux

I don't think you can fully disable telemetry in Windows

@@adamk.7177 Can't afford that move right now

@@adamk.7177btw

@@zokalyx yes, windows still collect info, mostly about errors

Agreed on the "one thing" part. GlobalProtect is a VPN feature. At the least, it should be containerized compared to the rest of the firewall.

You forgot, GlobalProtect is the VPN built into the firewall, so that's an external port open to the world. Oh, and the firewall is designed to and often used to MITM secure traffic on corporate networks...

This one is used by like every big manufacturing and tech company. I wonder who has been sipping the secrets away.

Nope. It's impossible to avoid vulnerabilities and bugs at some point no matter how perfect code you write. We are humans after all. It's hard to identify whether one has vulnerability against something.

@@ishanjaiswal9041 forget nuclear war. i wonder if the internets vulnerabilities themselves are a ticking timebomb, waiting for someone clever and malicious enough to deal catastrophic damage

The same, but in something safety-critical. For instance in Industry.

One that makes a poweplant go poof

It would be a vulnerability, which is unable to be patched just by code alone.

​@@Sypaka​software, firmware, microcode, and chip. A chip level defect is the worst, especially if it is a kind that cannot be mitigated by microcode or other patch.

they're FINDING them on a daily basis, you always had them though, they just went unnoticed longer

Because there are workarounds. Disable telemetry, enable the specific threat ID in the Vulnerability profile, etc

Honestly, same. I was about to go see if my distro had a patch/update, when im like lets just watch the first few minutes and check, so glad it's not netfilter/iptables.

@@fenix849 Haven't switched to nft yet? It's really good! I just hate that you can't remove iptables on every distro yet. One of the reasons why I switched to OpenBSD. Though their pf is shit. Don't let them fool you. It's completely backwards. Anyway, about nftables. If you switch, unlike pf, where you have to pretend it's iptables, in nft you have to think in ipv4 and ipv6, not in tables. Make one table for each and that's it, otherwise you can't use your sets in nat and filter at the same time.

Unplugging the server and ups from the wall also provides perfect security except for cases of physical access. I do agree with most of what you say to be fair.

something might just peddle through - with or without iptables..

Next: CVE in iptables by a backdoor using some wierd ass obscure lib

The problem is that firewalls on a host are not that easy to configure on a large scale, also doesn't support rules based on DNS, no real threat intelligence.

it might have a different name ? sharing IDS logs ?

Mmm... It makes me wonder, because telemetry in the windows sense would not provide an open port on the unsafe side of the firewall... It'd just connect directly to Palo Alto's servers and not provide an angle for arbitrary remote bad actors to get in. So this means it is either meant for the net admins to access data on their firewall remotely (which if you have any real security needs you should disable that and make it accessible LAN-side or VPN-side only), or... It's a backdoor for Palo Alto to use to get in, which might have a legitimate business use (helping unskilled admins configure their firewall), but it's also something any good admin who has half a clue what they're doing should turn off, specifically because of how much it increases your attack surface. Either of these are pretty similar to just allowing remote logins on a direct connection. Now, it's been a while since I used Palo Alto, so I don't remember if their firewalls had such features off the top of my head, but I know for sure the secure environment I was working in would have them disabled. But not every business *needs* a rigid security posture... And a lot will readily compromise security for ease of use, like... Paying Palo Alto themselves to configure a fire wall instead of paying an ongoing employee with enough skill to do more than the most basic daily admin tasks themselves. I've actually worked at a place that was *frustrated* by me having a similar skill level to the people on the expensive remote management contract they were paying for, and I got dressed down for fixing things myself instead of calling them and twiddling my thumbs while on hold.

@@psiah9889It’s becoming increasingly more prevalent to see people not being allowed to work on the things that they have for their own organization. We go through the same thing here and it’s so frustrating knowing we can fix it, yet we’re on a multiple day wait for the company to get back with us to fix something

It should not be enabled on a firewall. A firewall is a device where security is very important, so minimizing the attack surface of the software running on it is important. Telemetry is a part of the application that is interacts with the network, which increases the attack surface and potential for vulnerabilities. Telemetry is not the same thing as logging and isn't necessary.