APT groups exploiting VPNs to carry out cyber attacks

NCSC and NSA warn that services from Palo Alto, Fortinet and Pulse Secure are vulnerable

The National Cyber Security Centre (NCSC) and the National Security Agency (NSA) have both issued warnings about vulnerabilities that exist in some versions of widely-used virtual private network (VPN) services.

Highly severe flaws across the VPN services developed by Palo Alto Networks, Fortinet and Pulse Connect Secure top the list of vulnerabilities have been exploited by attackers to gain access to vulnerable devices.

Advertisement - Article continues below

The flaws identified by the NCSC stem from vulnerabilities that allow an attacker to retrieve arbitrary files by exploiting the VPN, including documents that could contain user credentials.

These stolen credentials can then be used to connect to the VPN and change settings, as well as connect with other infrastructure. Such a connection could also give attackers access to privileges needed to run secondary exploits that target access to the root shell.

"Users of these VPN products should investigate their logs for evidence of compromise, especially if it is possible that patches were not applied immediately after their release," the NCSC advisory said.

"Administrators should also look for evidence of compromised accounts in active use, such as anomalous IP locations or times. Snort rules are available in open source but may not pick up events for exploits over HTTPS."

Advertisement
Advertisement - Article continues below

The agency has also advised system administrators who suspect there may have been exploitation to revoke credentials that were at risk of theft, including both user and administrative credentials. Resetting credentials will protect against unauthorised access using credentials acquired before affected systems could have been patched.

Advertisement - Article continues below

"Pulse Secure are aware of and appreciated the reports published by NCSC," a spokesperson said.

"The more customers are made aware of severity of the vulnerabilities and the patch fix Pulse Secure had made available since April 24, 2019, the more motivated customers will be to take necessary and immediate mitigation action by upgrading their VPN system."

Related Resource

Why UEM is the key to enterprise IT security

A guide to effective endpoint security

Download now

The NSA, in its assessment, honed in on three critical Pulse Secure flaws that have been "weaponised" by nation state-sponsored cyber criminals. These vulnerabilities would allow for remote arbitrary file downloads and remote code execution on gateways.

The US agency also highlighted one critical vulnerability in Palo Alto GlobalProtect VPN that allowed for remote code execution, and another flaw in Fortinet Fortigate VPN devices.

"Our customer's security is our first priority and we urge customers to immediately implement all appropriate patch updates and signatures," Fortinet said.

"In addition to industry-leading best practices, we follow and comply with regular review processes that include multiple tiers of inspection, internal and third-party audits, and automated triggers and tools across the entire development of our source code."

The company added that it has recently improved its security practices, including the introduction of annual secure code training, a bug identification incentive programme, and automated monitoring of vulnerability landscape.

IT Pro also approached Palo Alto Networks for comment.

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
CSA and ISSA form cyber security partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do I fix the Windows 10 Start Menu if it's frozen?
operating systems

How do I fix the Windows 10 Start Menu if it's frozen?

3 Aug 2020