Blog

Weak Passwords: The Achilles’ Heel of VPN Security

posted by

Jessica Kelley

Introduction

In the ever-changing realm of cybersecurity, the brute force attacker remains a persistent adversary that has endured over time. As a favored tool in the arsenal of cybercriminals, brute force attacks continue to present a substantial danger to both organizations and individuals. This three-part blog series sets out on a voyage to explore the intricate landscape of brute force attacks, uncovering their enduring nature, their focus on virtual private networks (VPNs), and the ingenious methods and tools used by threat actors to amplify their effectiveness. In this blog post, we’ll discuss the following:

• Why brute force attacks persist and how they target virtual private networks (VPNs).
• The tools used by threat actors to increase the efficiency, scale, and accuracy of brute force attacks. For example, Shodan, which mass-scans the entire internet at all times, is used to identify IP addresses associated with corporate VPNs.
• The brute forcing process itself involves loading large word lists in an attempt to find the correct password. To maximize the success rate, many threat actors meticulously curate these wordlists by sorting through a plethora of malware logs and creating highly targeted wordlists based on actual passwords. This leads to exponentially higher success rates in brute force attacks.

Fortunately, following well-documented and established best practices such as multi-factor authentication (MFA) can prevent organizations from falling victim to most VPN brute forcing attempts.

Constant Attacks on Networks

Attacks on networks, specifically brute force attacks, have a long history and continue to be a “tool-of-choice” for many cybercriminals. These attacks are employed to guess and acquire login credentials for various accounts, including VPNs, with the aim of gaining initial entry into a more extensive network. While security measures have evolved over time to defend against such attacks, they still pose a significant risk.

Threat actors rely on a range of tools, one of which is Shodan, to facilitate brute force attacks. Shodan is a powerful search engine that continuously scans and indexes the entire internet, allowing threat actors to identify network vulnerabilities and access points. One of its primary utilities for attackers is locating VPN details, particularly IP addresses associated with VPNs. Using Shodan allows cybercriminals to quickly gather information about potential targets.

Use of Highly Targeted Wordlists

The brute force process involves using extensive word lists to try and find the correct password for a specific account. Threat actors put in significant effort to carefully craft these lists, gathering data from various sources like malware logs and employing different text processing tools. Their goal is to create highly targeted lists that include real passwords.

Creating these wordlists is a crucial step for threat actors aiming to increase their success rates in brute force attacks. They use information gathered from stolen data, such as login credentials acquired from previous data breaches or phishing incidents, as a starting point. Text processing software then refines this data, identifying patterns and generating variations of common passwords based on user behavior and preferences. Typically, each of these password lists encompasses a vast array of millions of distinct password combinations.

In many instances, within organizations the use of multi-factor authentication (MFA) is either optional or completely absent. Additionally, some VPN setups don’t enforce password expiration policies or use passwords that are too short.

Moreover, corporate VPN user accounts are often not connected to a centralized authentication system like Active Directory. Instead, they usually have their own set of credentials that are not tied to other organization systems. Therefore, these accounts might lack rules for strong passwords or regular password changes, making them more susceptible. Consequently, credentials obtained from malware victims are more likely to remain valid for extended periods, sometimes remaining usable for several years.

Prevention

It is crucial to strengthen the authentication process by implementing robust multi-factor authentication (MFA). This means making it mandatory for users to provide more than one form of identification when attempting to access the VPN. In addition to a password, users may be required to provide a security token or another form of verification. This approach significantly enhances the security of VPN access and makes it more resistant to unauthorized intrusion attempts. By implementing MFA, organizations can significantly reduce the risk of unauthorized access to their VPNs, making it much harder for threat actors to gain entry using stolen or guessed passwords alone. This added layer of security is essential in today’s threat landscape, where cyberattacks are becoming increasingly sophisticated.

* Disclaimer: This document is provided ‘as is’ for informational purposes only, without any warranties of any kind regarding any information contained within.