Devcore researchers discovered significant VPN security flaws recently specifically in three of the world’s most popular VPN tools. These flaws enable cybercriminals to access an organization’s confidential network in order to commit data theft.
The main researchers behind the discovery include Meh Chang and Orange Tsai from Devcore. This is mainly due to the fact that they implicate corporate VPNs from Pulse Secure, Fortinet and Palo Alto Networks.
Individual online users benefit from a VPN’s ability to protect online privacy while avoiding geo-restrictions. Businesses, on the other hand, use VPNs to enable remote and safe access to the network.
That’s why almost every corporate organization provides its employees with specific credentials and two-factor authentication. This way they can access the organization’s network via a VPN.
But, Tsai and Chang actually discovered VPN security flaws that would enable cybercriminals to access a corporation’s network without the use of authorized credentials and two-factor authentication.
What Are SSL VPNs?
Businesses typically use an SSL VPN because it allows employees to access the company’s network even while out of the office. The downside of this is that SSL VPNs can also open up a loophole for cybercriminals who’re looking to intrude on a company’s intranet.
While SSL VPNs keep corporate assets safe from exposure to the Internet, they’re not exactly safe. They’re fully open to the Internet and are often the only security measure that corporations have against cybersecurity threats. Once compromised SSL VPNs can open your company up to several risks and dangers such as cyberattacks from hackers.
This is all made possible by VPN security flaws that enable cybercriminals to infiltrate each and every device within the entire SSL VPN server.
Devcore’s research team also detailed the string flaw which impacted the GlobalProtect Gateway and GlobalProtect portal from Palo Alto. The PAN SSL Gateway has a remote code execution flaw known as CVE-2019-1579. It allows unauthorized threats to remotely infiltrate a company’s intranet.
Palo Alto did the right thing by letting its customers know about the problem though an advisory that recommended users to install the latest version of the software. Meanwhile, Fortinet did an update of its firmware to overcome the loophole. Then you have Pulse Secure that put out a patch to eliminate the threat.
How This Affects VPNs?
So, what are these VPN security flaws? VPNs have long been known for their ability to facilitate safe data transmission between server and client. That’s part of the reason why VPN technology is so popular and widely used around the world.
However, VPN solutions have been significantly impacted by SOX compliance mandates. How? For one, SOX mandates require businesses to provide end-to-end VPN security which is often not enough.
In addition, there needs to be detailed and targeted security policies that are applied on a group and individual level. This is where SOX comes in.
SOX requires organizations to apply customized security policies for all of the infrastructure’s users including sales, executives and more. That means that if an organization’s various security policies must be reflected in the company’s deployment of security solutions as well.
Not only that, but organizations must ensure the end-users’ systems are clean as well before giving them access to the VPN. This is completely different from VPNs which doesn’t consider the client a part of the overall security of the VPN. The introduction of end-to-end VPN security and SOX has led to significant changes in this process.
Conclusion
If VPN systems are unable to verify the end-client’s security settings then this shows up as a SOX compliance issue. Organizations can use various vendor technologies such as Cisco Clean Access to verify “clean” access. But VPNs are also starting to include this type of security technology into their suite of services as evidenced by providers like IPVanish.
Have you noticed any VPN security flaws within your company or organization? Sound off in the comments below. We’d love to hear from you!
