Attackers Target Check Point VPNs to Access Corporate Networks

In recent months, researchers have observed an increase in attackers using remote access virtual private networks (VPNs) as a golden ticket for initial network access. Multiple cybersecurity vendors' solutions have been compromised, according to a recent Check Point blog post, prompting them to look into their own gear and whether it's being targeted.

"As of May 24th, we have encountered three such attempts," reports Check Point's chief of staff, Gil Messing. "Upon further analysis by our special teams, we identified what we believe to be a potentially recurring pattern. While there have been only a few attempts globally, it's enough to recognize a trend and, more importantly, a straightforward [cause] to ensure it's unsuccessful."

Threats to Remote Access VPNs

Remote access VPNs are a bit different than the VPNs most people are used to. Where regular ones route an individual's Internet traffic through shared servers in order to conceal their Internet activity, remote access VPNs are used to provide specific individuals with secure access to specific networks. They're useful, for instance, in providing remote workers access to their employer's internal resources.

They're also useful for malicious purposes. Rather than having to, say, exploit a publicly facing server, or a zero-day vulnerability, a hacker could use a remote access VPN for clean, unfettered access to an organization's IT environment. From there, they could begin establishing persistence, probing for vulnerabilities, and much more. How, though, do they get access to that VPN connection in the first place?

The easiest way is via insufficiently protected accounts. In the cases Check Point uncovered, attackers attempted to leverage old VPN accounts that were protected only with a single password, but otherwise up for grabs.

Protecting Remote Access VPNs

To protect user accounts, besides monitoring or even disabling them, Check Point recommended that organizations require authentication checks beyond simple passwords.

Jason Soroko, senior vice president of product at Sectigo, echoes the point. "Username and password authentication is below the threshold of basic security, especially when much stronger forms of authentication are available. In addition to being insecure and inefficient, passwords are becoming increasingly inappropriate for many modern enterprise use-cases." This is especially true, he adds, when users end up keeping the usernames and passwords that come with the product by default, making the job of guessing them a cinch.

Instead, he suggests, "Many of today's enterprise applications already actively support modern alternatives to passwords by offering certificate-based authentication. It's stronger because it's based on an impossible-, or nearly impossible-to-guess secret that is not shared. The user experience is superior because once the user is provisioned, there is nothing for them to do except to initiate the authentication process. The authentication handshake takes place, and the VPN server can then be assured of who is authenticated. Username and password authentication gives no such assurance."

Others go further. "This is a stark reminder for organizations to make urgent plans to shift from legacy VPNs to Zero Trust Network Access (ZTNA) solutions," says Venky Raju, Field CTO at ColorTokens. He points to the latest Ivanti VPN balagan as an indication of where VPNs naturally fall short.

"ZTNA solutions have several advantages over VPNs," he says, "chief of which is that ZTNA inherently limits what the end user can access using the principles of least privilege. Also, ZTNA solutions have better integration with the enterprise's identity management system, reducing the risk of compromised passwords or misconfigurations."

Besides that, he adds, "Organizations should consult vendor documentation and advisories to remove unnecessary or unused features, implement strong authentication, audit all existing default accounts, and establish a patching process."