Guarding the Gateway: Protecting Your VPN in the Cyber Battlefield
Introduction
In our last blog post, we explored the security risks associated with weak passwords and their vulnerability to brute force attacks. In this second installment of our three-part series, we will delve into the following:
- Numerous organizations often mishandle the deployment of VPN client software to unprivileged users via web browsers, putting VPN credentials at risk of being exposed to malware theft.
- VPNs commonly suffer from vulnerabilities related to lax security practices, such as insufficient updates and a lack of multi-factor authentication. Additionally, inadequate logging of VPN endpoints can hamper threat detection and response.
- Threat actors target VPNs for various reasons, exploiting their vulnerabilities to gain continuous, round-the-clock access to corporate networks.
- Risk mitigation techniques include distributing VPN client software from a resource separate from the VPN appliance itself.
Exposing Credentials via the VPN Web User Interface (UI)
Brute force attacks on corporate VPNs continue to be very successful because a prevalent oversight in many organizations involves relying solely on VPN login credentials to manage the distribution of VPN client software to unprivileged individual users. While login credentials are vital for securing VPN access, the method through which unprivileged users acquire the VPN client is often inadequately restricted. Many organizations instruct their users to download the VPN client from the web UI, requiring them to input their VPN user credentials into the browser. In numerous instances, users are prompted by the browser to save their credentials for convenient future access, a tempting option amid the proliferation of many different usernames and passwords for applications, accounts, and software of all types.
However, this practice introduces a security risk as saving VPN credentials in the browser could expose them to compromise by malware. A more secure approach is to have unprivileged users download the VPN client separately from the VPN appliance itself which is less susceptible to compromise. Subsequently, users should only input their VPN credentials into their VPN application itself, and not through any browser where these credentials may be saved and exposed to future theft by malware.
Furthermore, VPNs often suffer from two additional shortcomings. Firstly, network endpoints are frequently neglected when it comes to applying the latest security updates. Even when updates are implemented, the utilization of multi-factor authentication (MFA) is either discretionary or absent altogether, as discussed in our previous blog post. Moreover, some VPN configurations lack password expiration policies or employ insufficient password lengths.
If a VPN is not kept up-to-date, threat actors can easily scan for and discover vulnerable ones. Remarkably, even after three years since its identification, many threat actors continue to actively exploit a Fortinet VPN vulnerability (CVE-2018-13379-Fortinet).1 Preventing such attacks can be achieved by consistently ensuring that the VPN application is running the latest updates.
Another prevalent issue stems from improper VPN setup, specifically inadequate or non-existent logging of VPN endpoints. This absence of comprehensive logging mechanisms increases the risk of suspicious activities going unnoticed, rendering detection and response to potential threats significantly more challenging.
Notably, many threat actors heavily depend on openly published proof-of-concept (PoC) exploits shared by cybersecurity experts or other individuals, which they can easily access through simple Google searches. This implies that these threat actors don’t necessarily require advanced ‘hacking’ skills; they can simply utilize readily available information for their malicious activities.
Why are VPN credentials so sought after?
Threat actors have various motivations for targeting networks via VPNs. In many cases, organizations configure their networks in a way that relies solely on the VPN connection as the primary defense between the internal network and the internet. The VPN is intended to offer secure access for users over the internet. However, this setup can become vulnerable if the VPN lacks proper security measures, such as the use of a DMZ, also known as a demilitarized zone. A DMZ functions as a perimeter network, providing an extra layer of security and network segmentation to safeguard internal corporate local-area networks from untrusted traffic. Unfortunately, due to the costs and administrative efforts associated with implementing and maintaining such robust security measures, many corporate entities opt for regular VPN setups.
Here is a diagram of most general network designs:
What a corporate network at the bare minimum should look like2:
Secondly, by exploiting compromised VPN credentials to attack a network, threat actors can avoid the reliance on active malware infections, which tend to have relatively short lifespans. This grants cybercriminals continuous access, as compromised VPN credentials remain available 24/7, affording them ample time to strategize and execute their attacks effectively.
Lastly, as detailed in our previous blog post, corporate VPN user accounts are not directly linked to any centralized authentication system such as Active Directory. Instead, they often have a separate credential set independent of other systems in the organization. Consequently, these accounts might lack password complexity rules or regular password change policies, leaving them more vulnerable. As a result, credentials obtained from malware victims have a higher chance of remaining valid for extended periods, sometimes remaining usable for several years.
Mitigating Risks
To bolster VPN client security, a key step is to implement restricted downloads. This entails making sure that only unprivileged users can access the VPN client through a secure webserver. This practice minimizes the chances of compromise and adds an extra safeguard to the VPN application, shielding it from potential threats.
Furthermore, implementing robust authentication with multi-factor authentication (MFA) can greatly reduce the risk of VPN compromise. By requiring users to provide multiple forms of identification, such as a password and a security token, accessing the VPN becomes significantly more secure and resilient against unauthorized intrusion attempts.
Equally crucial is the regular maintenance of VPN software. Organizations must prioritize this task to keep their networks secure. By consistently updating VPN software and promptly patching any vulnerabilities, they can effectively mitigate the risk of potential attacks, ensuring a robust defense against evolving cybersecurity threats.
* Disclaimer: This document is provided ‘as is’ for informational purposes only, without any warranties of any kind regarding any information contained within.
2https://www.networkdefenseblog.com/amp/network-vpn-design