Black Hat USA 2025 | Use and Abuse of Palo Alto's Remote Access Solution

Why It Matters

The vulnerability enables low‑privilege attackers to bypass corporate VPN controls, facilitating data exfiltration and stealthy C2, prompting urgent reassessment of split‑tunnel security across enterprises.

Key Takeaways

• GlobalProtect split‑tunnel relies on insecure DNS‑based routing for traffic
• Attacker‑controlled DNS can spoof domains to bypass VPN
• IPC encryption uses predictable keys, allowing low‑privilege replay attacks
• Process‑path verification is fragile, can be tricked with short names
• Linux client resists bypass, but macOS client remains vulnerable

Summary

The presentation examined Palo Alto’s GlobalProtect remote‑access solution, focusing on its split‑tunnel feature that lets administrators whitelist domains such as *.zoom.us to bypass the VPN. The speaker, a security engineer with pentesting background, demonstrated how the feature intertwines DNS resolution with IP‑level routing, creating a surface for abuse.

By directing a compromised DNS server to return a malicious IP for a whitelisted domain, an attacker can force traffic to exit the corporate tunnel unnoticed. The demo showed a low‑privilege shell issuing DNS queries for a fake sub‑domain, receiving the attacker‑controlled address, and then reaching Dropbox for data exfiltration. The route persisted in cache for about a minute, illustrating a practical bypass.

Further analysis revealed that GlobalProtect’s inter‑process communication encrypts messages with a static IV and a key derived from a login‑keychain entry on macOS—or hard‑coded on Linux—offering little protection against a privileged user. By manipulating the process‑path check (using LSOF redirection or a short binary name), the researchers could replay a disconnect command and force the VPN to drop, allowing unrestricted internet access. Linux’s implementation resisted these tricks, highlighting platform‑specific disparities.

The findings underscore a design flaw: reliance on unauthenticated DNS and fragile validation logic that fails open. Enterprises using GlobalProtect should consider DNSSEC, stricter split‑tunnel policies, and deeper monitoring of outbound traffic, while Palo Alto must redesign the feature to enforce secure defaults and robust IPC authentication.

Original Description

Palo Alto Networks' GlobalProtect is a widely adopted remote access solution used by major organisations worldwide — but how robust is it?

Is it designed following secure development principles? Is it possible that this highly-privileged agent, typically installed on all user endpoints, could actually be a source of vulnerability?

In this talk, I will introduce and discuss the research that led to the discovery of several security vulnerabilities that could be used to bypass the VPN or escalate privileges on MacOS and Linux endpoints with GlobalProtect installed.

As well as providing technical details and practical demonstration of the vulnerabilities, I'll provide an overview of how the GlobalProtect client works and consider its design from the security engineer's perspective. I'll explore fundamental design decisions whose overlooked risks directly contributed to the discovered vulnerabilities.

By:

Alex Bourla | Security Engineer and Researcher,

Graham Brereton | Senior Software Engineer, Form3

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#turning-the-tables-on-globalprotect-use-and-abuse-of-palo-altos-remote-access-solution-46051