APT groups exploiting VPNs to carry out cyber attacks

NCSC and NSA warn that services from Palo Alto, Fortinet and Pulse Secure are vulnerable

The National Cyber Security Centre (NCSC) and the National Security Agency (NSA) have both issued warnings about vulnerabilities that exist in some versions of widely-used virtual private network (VPN) services.

Highly severe flaws across the VPN services developed by Palo Alto Networks, Fortinet and Pulse Connect Secure top the list of vulnerabilities have been exploited by attackers to gain access to vulnerable devices.

The flaws identified by the NCSC stem from vulnerabilities that allow an attacker to retrieve arbitrary files by exploiting the VPN, including documents that could contain user credentials.

These stolen credentials can then be used to connect to the VPN and change settings, as well as connect with other infrastructure. Such a connection could also give attackers access to privileges needed to run secondary exploits that target access to the root shell.

"Users of these VPN products should investigate their logs for evidence of compromise, especially if it is possible that patches were not applied immediately after their release," the NCSC advisory said.

"Administrators should also look for evidence of compromised accounts in active use, such as anomalous IP locations or times. Snort rules are available in open source but may not pick up events for exploits over HTTPS."

The agency has also advised system administrators who suspect there may have been exploitation to revoke credentials that were at risk of theft, including both user and administrative credentials. Resetting credentials will protect against unauthorised access using credentials acquired before affected systems could have been patched.

"Pulse Secure are aware of and appreciated the reports published by NCSC," a spokesperson said.

"The more customers are made aware of severity of the vulnerabilities and the patch fix Pulse Secure had made available since April 24, 2019, the more motivated customers will be to take necessary and immediate mitigation action by upgrading their VPN system."

Related Resource

Why UEM is the key to enterprise IT security

A guide to effective endpoint security

Download now

The NSA, in its assessment, honed in on three critical Pulse Secure flaws that have been "weaponised" by nation state-sponsored cyber criminals. These vulnerabilities would allow for remote arbitrary file downloads and remote code execution on gateways.

The US agency also highlighted one critical vulnerability in Palo Alto GlobalProtect VPN that allowed for remote code execution, and another flaw in Fortinet Fortigate VPN devices.

"Our customer's security is our first priority and we urge customers to immediately implement all appropriate patch updates and signatures," Fortinet said.

"In addition to industry-leading best practices, we follow and comply with regular review processes that include multiple tiers of inspection, internal and third-party audits, and automated triggers and tools across the entire development of our source code."

The company added that it has recently improved its security practices, including the introduction of annual secure code training, a bug identification incentive programme, and automated monitoring of vulnerability landscape.

IT Pro also approached Palo Alto Networks for comment.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Weekly threat roundup: SAP, Windows 10, Chrome
vulnerability

Weekly threat roundup: SAP, Windows 10, Chrome

21 Jan 2021
Biden nominees highlight tough cyber security challenges
cyber security

Biden nominees highlight tough cyber security challenges

20 Jan 2021
Report: Security staff excluded from app development
cyber security

Report: Security staff excluded from app development

20 Jan 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

20 Jan 2021

Most Popular

Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021