Monash Uni infosec staff find gaping security hole in Palo Alto Networks gear – Security- Tempemail – Blog – 10 minute

Palo Alto Networks has issued patches for a critical authentication bypass in several of its enterprise security products that was reported to the security vendor by two Monash University infosec staff.
The flaw, discovered by cybersecurity systems analyst Salman Khan and systems engineer Cameron Duck at Monash University, rates 10 out of 10 on the Common Vulnerabilities Scoring System (CVSS) version 3, and is easy to exploit with no user interaction required.
“When Security Assertion Markup Language (SAML) authentication is enabled and the ‘Validate Identity Provider Certificate’ option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources,” the security vendor wrote in its advisory.
Multiple versions of the Palo Alto’s PAN-OS running on the company’s firewall, gateway, virtual private networking and access products are affected by the flaw.
Upgrading to PAN-OS versions 8.1.15, 9.0.9 and 9.1.3 fixes the authentication bypass vulnerability.
The United States government cyber command advised users to patch all their Palo Alto Networks devices immediately, warning that overseas nation-state sponsored hackers would likely try to exploit the vulnerability.

Please patch all devices affected by CVE-2020-2021 immediately, especially if SAML is in use. Foreign APTs will likely attempt exploit soon. We appreciate @PaloAltoNtwks’ proactive response to this vulnerability.
https://t.co/WwJdil5X0F
— USCYBERCOM Cybersecurity Alert (@CNMF_CyberAlert) June 29, 2020
If it’s not possible to immediately patch against the vulnerability, Palo Alto Networks said configuring the SAML authentication with a Certificate Authority (CA) Identity Provider Certificate, along with enabling validation of the credential, can be used as a complete mitigation for the vulnerability.
If SAML is not used for authentication, the bypass bug can’t be exploited, Palo Alto Networks said.
For now, the security vendor is not aware of any attempts at exploiting the vulnerability.
Attempts at exploiting the vulnerability can be logged by systems, but Palo Alto Networks said it can be difficult to distinguish between valid and malicious logins or sessions.
Unusual user names or source internet protocol addresses found in system logs are indicators of compromise, Palo Alto Networks warned.

Tempemail , Tempmail Temp email addressess (10 minutes emails)– When you want to create account on some forum or social media, like Facebook, Reddit, Twitter, TikTok you have to enter information about your e-mail box to get an activation link. Unfortunately, after registration, this social media sends you dozens of messages with useless information, which you are not interested in. To avoid that, visit this Temp mail generator: tempemail.co and you will have a Temp mail disposable address and end up on a bunch of spam lists. This email will expire after 10 minute so you can call this Temp mail 10 minute email. Our service is free! Let’s enjoy!

Palo Alto Networks Intents to Acquire CloudGenix to Extend the Secure Access Service Edge (SASE) Platform- Tempemail – Blog – 10 minute

Read Article
Palo Alto Networks, the global cybersecurity firm, today announced that it has entered into a definitive agreement to acquire CloudGenix, Inc., a cloud-delivered SD-WAN provider. Under the terms of the agreement, Palo Alto Networks will pay approximately $420 million in cash to acquire CloudGenix, subject to adjustments. The acquisition is expected to close during Palo Alto Networks’ fiscal fourth quarter, subject to the satisfaction of regulatory and customary closing conditions.
As applications continue to move from corporate data centers to the cloud and SaaS, and users require secure access to applications from anywhere in the world, organizations are struggling to manage access for the distributed workforce. Current remote access solutions for the branch and retail offices are complex, costly and often insecure. To support the modern workforce, organizations need access to all applications from all locations, delivered via a global network as a service for accelerated access, and with integrated world-class security from the cloud. This is what the industry calls “secure access service edge,” or SASE.
Palo Alto Networks Prisma™ Access is the industry’s most comprehensive SASE platform, delivering a global cloud network with cloud-delivered security for all users. With the proposed acquisition, Palo Alto Networks will integrate CloudGenix’s cloud-managed SD-WAN products to accelerate the intelligent onboarding of remote branches and retail stores into Prisma Access. This combination will extend the breadth of the Prisma Access SASE platform, address network and security transformation requirements, and accelerate the shift from SD-WAN to SASE.
CloudGenix has attracted approximately 250 customers, many of which are in the Fortune 1000 and include companies in healthcare, retail, manufacturing, finance, banking, tech and hospitality. CloudGenix was named a 2020 Gartner Peer Insights Customers’ Choice for WAN Edge Infrastructure. CloudGenix co-founders, Kumar Ramachandran, Mani Ramasamy and Venkataraman Anand, have agreed to join Palo Alto Networks.

“As the enterprise becomes more distributed, customers want agile solutions that just work, and that applies to both security and networking. Upon the close of the transaction, the combined platform will provide customers with a complete SASE offering that is best-in-class, easy to deploy, cloud-managed, and delivered as a service.”
– Nikesh Arora, chairman and CEO, Palo Alto Networks

If you have an interesting article / experience / case study to share, please get in touch with us at [email protected]

Tempemail , Tempmail Temp email addressess (10 minutes emails)– When you want to create account on some forum or social media, like Facebook, Reddit, Twitter, TikTok you have to enter information about your e-mail box to get an activation link. Unfortunately, after registration, this social media sends you dozens of messages with useless information, which you are not interested in. To avoid that, visit this Temp mail generator: tempemail.co and you will have a Temp mail disposable address and end up on a bunch of spam lists. This email will expire after 10 minute so you can call this Temp mail 10 minute email. Our service is free! Let’s enjoy!

43% of cloud databases are not encrypted: Palo Alto Networks- Tempemail – Blog – 10 minute

Read Article
On 5th February, Unit 42 (the Palo Alto Networks threat intelligence team) released the Spring 2020 edition of its Cloud Threat Report, which aims to uncover where cloud vulnerabilities are surfacing in the threat landscape among the widespread shift to cloud infrastructure.
Over the last 18 months, the Unit 42 team witnessed a radical shift in how DevOps teams are building their cloud infrastructure. Organizations are rapidly adopting infrastructure as code (IaC) as they attempt to automate more of their build processes in the cloud. When teams move to IaC, this means they are avoiding the manual creation and configuration of infrastructure in favor of writing code. Although IaC is not new, many organizations are adopting it for the first time—which means new risks.
Some key findings include:
Nearly 200,000 insecure templates Researchers found an astonishing number of templates with high and medium severity vulnerabilities, yet it only takes one such misconfiguration to compromise an entire cloud environment. Just as when you forget to lock your car or leave a window open, an attacker can use these mis-configurations to weave around defenses. This high number explains why, in a previous report, we found that 65% of cloud incidents were due to customer misconfigurations. Without secure IaC templates from the start, cloud environments are ripe for attack.
43% of cloud databases are not encrypted Unencrypted data is like having a house with glass walls; someone can walk by and see exactly what is happening inside. Keeping data encrypted prevents attackers from reading the information stored. Encryption of data is also a requirement of many compliance standards, such as PCI and HIPAA. The recent breaches of Vistaprint and MoviePass highlight the importance of having encrypted databases.
60% of cloud storage services have logging disabled A business would never tolerate having over half of its warehouses not keeping a logbook nor would they omit security cameras on doorways, as that would make it impossible to track who has accessed the facility. When storage logging is disabled, malicious actors from CloudHopper to Fancy Bear could enter the storage system and no one would ever know. Storage logging is critical when attempting to determine the scale of the damage in such cloud incidents as the U.S. Voter Records leak or the Tempemail Credit Federation data leak.
76% of cloud workloads expose SSH (port 22)Exposing SSH servers to the entire internet is a risky practice. Attackers actively target SSH services as they provide remote access to cloud environments. Security teams should focus on moving away from trust-based access models like accounts and passwords toward those that embody the Zero Trust approach of “never trust, always verify.” The fact this service’s exposure is on an upward trend is concerning.
69% of organizations expose RDP (port 3389)Pick your poison: RDP or SSH. When publicly exposed, either of these services allows attackers to knock on your front door when they shouldn’t even know it’s there. Researchers recommend strongly against directly exposing RDP to the public internet. Many alternatives now exist, such as Azure® Bastion, which is a PaaS service offered by Microsoft. The alarming upward trend is something to watch closely between reports.
27% of organizations use outdated versions of Transport Layer Security (TLS)TLS v1.1 was abandoned in 2008. In addition to violating compliance requirements, such as PCI, organizations are putting their customers’ data at risk. Having this number on a downward trend is good news for customer security and privacy

If you have an interesting article / experience / case study to share, please get in touch with us at [email protected]

Tempemail , Tempmail Temp email addressess (10 minutes emails)– When you want to create account on some forum or social media, like Facebook, Reddit, Twitter, TikTok you have to enter information about your e-mail box to get an activation link. Unfortunately, after registration, this social media sends you dozens of messages with useless information, which you are not interested in. To avoid that, visit this Temp mail generator: tempemail.co and you will have a Temp mail disposable address and end up on a bunch of spam lists. This email will expire after 10 minute so you can call this Temp mail 10 minute email. Our service is free! Let’s enjoy!

Palo Alto Networks intends to acquire Zingbox for $75M – gpgmail


Palo Alto Networks surely loves to buy security startups. Today it added to its growing collection when it announced its intent to acquire IoT security startup Zingbox for $75 million.

The company had raised $23.5 million, according to Crunchbase data. The three co-founders, Xu Zou, May Wang and Jianlin Zeng, will be joining Palo Alto after the sale is official.

With Zingbox, the company gets IoT security chops, something that is increasingly important as companies deploy internet-connected smart devices and sensors. While these tools can greatly benefit customers, they also often carry a huge security risk.

Zingbox, which was founded in 2014, gives Palo Alto a modern cloud-based solution built on a subscription model along with engineering talent to help build out the solution further. Nikesh Arora, chairman and CEO of Palo Alto Networks, certainly sees this.

“The proliferation of IoT devices in enterprises has left customers facing an enormous gap in protection against cybersecurity attacks. With the proposed acquisition of Zingbox, we will provide a first-of-its-kind subscription for our Next-Generation Firewall and Cortex platforms that gives customers the ability to gain control, visibility and security of their connected devices at scale,” Arora said in a statement.

This is the fourth security startup the company has purchased this year. It acquired two companies, nabbing PureSec and Twistlock, on the same day last Spring. Earlier this year, it bought Demisto for $560 million. All of these acquisitions are meant to build up the company’s portfolio of modern security offerings without having to build these kinds of tools in-house from scratch.


10 minutes mail – Also known by names like : 10minemail, 10minutemail, 10mins email, mail 10 minutes, 10 minute e-mail, 10min mail, 10minute email or 10 minute temporary email. 10 minute email address is a disposable temporary email that self-destructed after a 10 minutes. https://tempemail.co/– is most advanced throwaway email service that helps you avoid spam and stay safe. Try tempemail and you can view content, post comments or download something