Vulnerabilities exploited in VPN products used worldwide
APTs are exploiting vulnerabilities in several VPN products used worldwide
Published: 2 October 2019
Introduction
The NCSC is investigating the exploitation, by Advanced Persistent Threat (APT) actors, of known vulnerabilities affecting Virtual Private Network (VPN) products from vendors Pulse secure, Palo Alto and Fortinet.
This activity is ongoing, targeting both UK and international organisations. Affected sectors include government, military, academic, business and healthcare. These vulnerabilities are well documented in open source.
Details
Vulnerabilities exist in several SSL VPN products which allow an attacker to retrieve arbitrary files, including those containing authentication credentials.
An attacker can use these stolen credentials to connect to the VPN and change configuration settings, or connect to further internal infrastructure.
Unauthorised connection to a VPN could also provide the attacker with the privileges needed to run secondary exploits aimed at accessing a root shell.
Top vulnerabilities
The highest-impact vulnerabilities known to be exploited by APTs are listed below, although this is not an exhaustive list of CVEs associated with these products.
…
Detecting exploitation…
Essential mitigation…
If you suspect exploitation…
Download – pdf, 207 KB, 5 PAGES:
APTs exploit multiple VPNs
The NCSC is investigating the exploitation, by APT actors, of known vuln…
Read the full article here
NCSC-supplied information published under their Open Government Licence
