Devcore researchers discovered significant VPN security flaws recently specifically in three of the world’s most popular VPN tools. These flaws enable cybercriminals to access an organization’s confidential network in order to commit data theft.
The main researchers behind the discovery include Meh Chang and Orange Tsai from Devcore. This is mainly due to the fact that they implicate corporate VPNs from Pulse Secure, Fortinet and Palo Alto Networks.
That’s why almost every corporate organization provides its employees with specific credentials and two-factor authentication. This way they can access the organization’s network via a VPN.
But, Tsai and Chang actually discovered VPN security flaws that would enable cybercriminals to access a corporation’s network without the use of authorized credentials and two-factor authentication.
What Are SSL VPNs?
Businesses typically use an SSL VPN because it allows employees to access the company’s network even while out of the office. The downside of this is that SSL VPNs can also open up a loophole for cybercriminals who’re looking to intrude on a company’s intranet.
While SSL VPNs keep corporate assets safe from exposure to the Internet, they’re not exactly safe. They’re fully open to the Internet and are often the only security measure that corporations have against cybersecurity threats. Once compromised SSL VPNs can open your company up to several risks and dangers such as cyberattacks from hackers.
This is all made possible by VPN security flaws that enable cybercriminals to infiltrate each and every device within the entire SSL VPN server.
Devcore’s research team also detailed the string flaw which impacted the GlobalProtect Gateway and GlobalProtect portal from Palo Alto. The PAN SSL Gateway has a remote code execution flaw known as CVE-2019-1579. It allows unauthorized threats to remotely infiltrate a company’s intranet.
Palo Alto did the right thing by letting its customers know about the problem though an advisory that recommended users to install the latest version of the software. Meanwhile, Fortinet did an update of its firmware to overcome the loophole. Then you have Pulse Secure that put out a patch to eliminate the threat.
Attention: Read before you continue
Governments and ISPs across the world monitor their users online activities. If found streaming or browsing content on your Fire TV Stick, mobile or PC, you could get into serious trouble.
Currently, the following information is visible:
- Your IP:
- Your Country:
- Your City:
- Your ISP:
If this is your real information, you need to use a VPN to protect your identity.
We strongly recommend you to get a good VPN and hide your identity so that your online experience doesn’t take a bad turn.
We use IPVanish which is the fastest and most secure VPN in the industry. It is very easy to install on any device including Amazon Fire TV Stick. Also, it comes with a 30-day money-back guarantee. If you don’t like their service, you can always ask for a refund. IPVanish also runs a limited time offer where you can save 74% on your VPN and they allow you to use one account on unlimited devices.
This is a flash sale that can expire at any time!
How This Affects VPNs?
So, what are these VPN security flaws? VPNs have long been known for their ability to facilitate safe data transmission between server and client. That’s part of the reason why VPN technology is so popular and widely used around the world.
However, VPN solutions have been significantly impacted by SOX compliance mandates. How? For one, SOX mandates require businesses to provide end-to-end VPN security which is often not enough.
In addition, there needs to be detailed and targeted security policies that are applied on a group and individual level. This is where SOX comes in.
SOX requires organizations to apply customized security policies for all of the infrastructure’s users including sales, executives and more. That means that if an organization’s various security policies must be reflected in the company’s deployment of security solutions as well.
Not only that, but organizations must ensure the end-users’ systems are clean as well before giving them access to the VPN. This is completely different from VPNs which doesn’t consider the client a part of the overall security of the VPN. The introduction of end-to-end VPN security and SOX has led to significant changes in this process.
If VPN systems are unable to verify the end-client’s security settings then this shows up as a SOX compliance issue. Organizations can use various vendor technologies such as Cisco Clean Access to verify “clean” access. But VPNs are also starting to include this type of security technology into their suite of services as evidenced by providers like IPVanish.
Have you noticed any VPN security flaws within your company or organization? Sound off in the comments below. We’d love to hear from you!