AI
DNS Spoofing to Bypass the Split-Tunnel
Global Protect’s wildcard split-tunnel feature routes traffic by watching DNS responses and adding a direct internet route for whatever IP the resolver returns. An attacker with a low-privileged shell can query any subdomain matching the wildcard against an attacker-controlled DNS server, which returns the C2 IP. Global Protect tags that IP as trusted and sends traffic straight to the internet, bypassing all monitoring.
He walked through the DNS spoofing bypass demo (05:25) live, reaching Dropbox outside the tunnel in seconds. The route persists about a minute after DNS queries stop. Palo Alto declined to treat this as a vulnerability; environments with wildcard rules remain exposed.
IPC Protocol Internals and Weak Process Verification
PanGPS and PanGPA talk over a localhost TCP server on port 4767. The traffic is CBC-encrypted, but the IV is all zeros, hardcoded. On macOS the key derives from the login keychain, which any low-privileged user can read. On Linux the key is the literal string “Global 35 protect.” The encryption does nothing against a local attacker.
With the protocol decoded, the disconnect command is visible and replayable. PanGPS blocks replays by running lsof, parsing its ASCII output for a PID, then checking that PID’s binary path against the trusted Global Protect directory. Parsing text output from a subprocess to make a security decision is fragile by design.
Fail-Open Logic and Tunnel Disconnect Without Credentials
The is_connected_by_pan flowchart fails open: any error at any step passes the check. A process name under nine characters leaves no token between the first two space delimiters in the lsof output; the integer parse defaults to zero; PID 0 lookup fails; the VPN disconnects without credentials.
“wrong the verification passes.” — Alex Bourla
He demonstrated the short process name bypass demo (16:16) on macOS, then used the LD_PRELOAD bypass demo (18:35) on Linux, injecting code into a trusted PanGPA binary to send the disconnect message. Linux’s /proc filesystem blocks the macOS lsof spoofing, but not library injection.
Privilege Escalation via OpenSSL and Child Process Inheritance
PanGPS runs with a suid bit and spawns two child processes for host-information collection. The children run as root with real UID 0 and inherit all environment variables. PanGPS itself strips PATH and ignores OPENSSL_CONF because its real UID is 501, but that protection never applies to the children.
OpenSSL reads OPENSSL_CONF and loads any engine it points at. Faking the parent process arg0 to read as launchd passes PanGPS’s launch check. Once PanGPS spawns a child, the engine loads and runs as root. The root shell via OpenSSL CONF priv-esc demo (26:49) confirms:
“we’re root.” — Alex Bourla
Disclosure, Failed Patches, and Architectural Lessons
Palo Alto was notified of the DNS bypass in April 2024 and declined to fix it. The IPC bugs were patched, but the first patch deleted the lsof check rather than repairing it, so any process could send the disconnect message. The new implementation checked port numbers but always identified PanGPS’s own port as the trusted side.
“Secondly, bad design can’t be patched.” — Alex Bourla
The privilege-escalation bugs were reported for macOS only; Palo Alto’s advisories list Windows and Linux as affected. The IPC vulns are resolved after a second patch. The structural problem remains: security decisions run in the unprivileged process, on the attacker’s side of the trust boundary.
Q&A
Did you test the DNS-based split-tunnel bypass on the Windows Global Protect client? Bourla did not test Windows due to their working environment, but said the same wildcard split-tunnel feature exists there and the attack likely applies; the privilege-escalation advisories confirm Windows is affected. ▶ 35:07
Is any other VPN client that supports split tunneling susceptible to the same DNS spoofing attack? Bourla checked documentation across providers and found no other VPN that supports wildcard domain exclusions; the wildcard is the specific condition that makes the attack possible, not split tunneling alone. ▶ 36:28
Notable Quotes
it, there’s trust in the DNS server. Alex Bourla · ▶ 6:46
wrong the verification passes. Alex Bourla · ▶ 15:25
Secondly, bad design can’t be patched. Alex Bourla · ▶ 33:15
Key Takeaways
- Any Global Protect wildcard split-tunnel rule can be abused from a low-privileged shell to route traffic outside the VPN tunnel.
- The IPC process-identity check fails open on errors, letting a binary with a short name disconnect the VPN without credentials.
- PanGPS child processes run as root and inherit environment variables, giving attackers a path from local user to root via OPENSSL_CONF.