Attacks/Breaches
4/21/2014
09:00 AM
Connect Directly
RSS
E-Mail
50%
50%

Heartbleed Attack Targeted Enterprise VPN

Attack spotted using the OpenSSL Heartbleed bug to steal session tokens and bypass two-factor authentication.

Now there's live proof the Heartbleed bug can be exploited, not just to steal private SSL keys stored on a server, but also to retrieve VPN session tokens.

Researchers at Mandiant -- now part of threat intelligence firm FireEye -- on Friday revealed that they spotted a successful VPN-targeting attack that began April 8. That was just one day after OpenSSL issued a public security advisory about a "TLS heartbeat read overrun" in its open-source SSL and TLS implementation. 

The flaw, later dubbed "Heartbleed," was quickly tapped by a VPN-targeting attacker. "The attacker repeatedly sent malformed heartbeat requests to the HTTPS Web server running on the VPN device, which was compiled with a vulnerable version of OpenSSL, to obtain active session tokens for currently authenticated users," said Mandiant technical director Christopher Glyer and senior consultant Chris DiGiamo in a blog post. "With an active session token, the attacker successfully hijacked multiple active user sessions and convinced the VPN concentrator that he/she was legitimately authenticated."

The researchers declined to name the organization that was targeted, but said the attacker's aims didn't appear to be academic. "Once connected to the VPN, the attacker attempted to move laterally and escalate his/her privileges within the victim organization," they said.

But many businesses might not know that attackers could exploit Heartbleed to grab legitimate VPN session tokens, which also allowed the attacker to bypass the organization's two-factor authentication system, as well as a check -- built into the VPN client software -- meant to ensure that prescribed security software was running on the client. "To date, much of the discussion on the Internet has focused on an attacker using the vulnerability to steal private keys from a Web server, and less on the potential for session hijacking," the Mandiant researchers said. 

Even so, a related warning was sounded April 8, when the first proof-of-concept exploit for stealing private SSL keys via the Heartbleed bug was published -- in the form of a Python script -- which led Web application penetration tester Matthew Sullivan to warn about the potential for session-token-stealing attacks to occur. "The currently available proof-of-concept scripts allow any client, anywhere in the world, to perform a session hijacking attack of a logged-in user," he said in a blog post.

Such an attack, Sullivan added, could also bypass the need for an attacker to provide authentication credentials, and could be used against "any Web service that uses cookies to track the session state -- almost every site on the Internet." Furthermore, related attacks might be tough to spot. "The only way to detect this type of attack is to check the source IPs of traffic for each and every request." 

In the case of the VPN exploit detailed by Mandiant, the intrusion apparently came to light after the targeted organization added intrusion detection system (IDS) signatures designed to spot signs of Heartbleed-related exploits on the network. Mandiant said it later verified the intrusion by reviewing both IDS signatures and VPN logs.

With the right IDS signatures in place, this intrusion was apparently tough to miss, with Mandiant noting that the organization's related IDS signature "alerted over 17,000 times during the intrusion," with all alerts pointing to its internal SSL VPN appliance. As that suggests, exploiting the Heartbleed bug to retrieve a legitimate session token or private key may require an extended effort that takes hours to unfold. "In our experience, an attacker will likely send hundreds of attempts because the vulnerability only exposes up to 64KB of data from a random section of memory," said Mandiant.

To guard against Heartbleed attacks -- against VPN systems or otherwise -- Mandiant recommended updating vulnerable VPN systems as soon as possible. To date, many sites have already rushed to patch the Heartbleed bug, although some large vendors have yet to compile definitive lists of all products that are vulnerable or release-related patches.

According to a DarkReading flash poll, as of Friday, 60 percent of respondents said they've installed Heartbleed fixes on servers, although only about 40 percent said they'd replace digital certificates, and just 30 percent planned to force users to change their passwords.

Mandiant also suggested reviewing logs for signs of previous intrusions, which could be indicated by any VPN session in which a session's IP address changed rapidly between two IP addresses -- one of which might be legitimate, and the other controlled by an attacker. "It is common for an IP address to legitimately change during a session, but from our analysis it is fairly uncommon for the IP address to repeatedly change back and forth between IP addresses that are in different network blocks, geographic locations, from different service providers, or rapidly within a short time period."

Finally, Mandiant recommended businesses add IDS signatures designed to spot Heartbleed-related activity. But while such signatures may make VPN session token attacks easy to spot, they won't unearth all types of Heartbleed-related exploits. For example, the "Heartleech" proof-of-concept attack software posted to GitHub last week by Robert David Graham, CEO of Errata Security, is designed to evade detection by Snort IDS rules, while using an "autopwn" process to automate the process of stealing SSL keys. 

"Go away from your computer for many hours, and when you come back, you'll have the key," Graham said. 

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JessicaP494
50%
50%
JessicaP494,
User Rank: Apprentice
7/6/2014 | 1:42:27 AM
get the best vpn service with waselpro
you can surf the internet and blocked websites verey easy with waselprovpn service , you can speed up ypur internet programs , change and hide your ip address , secure your use on the internet , the program work on computers and all kind of mobile devices ,

http://www.bestcheapvpnservice.com/cheap-vpn-solution-for-small-business/
AaronB062
50%
50%
AaronB062,
User Rank: Apprentice
4/25/2014 | 4:16:29 PM
Heartbleed is bad, but session hijacking is not new
Session hijacking is not a new risk, but it is somewhat of a sleeper. It's not likely something that is at the top of the agenda for every organization's security update meeting – but it should be.  In fact, OWASP puts session management collectively with authentication management and lists them as No. 2 in the top 10 vulnerabilities from 2013.  We have been concerned about this vulnerability and have worked with our customers on session management and protection against session hijacking and replay.
AmmarNaeem
50%
50%
AmmarNaeem,
User Rank: Apprentice
4/22/2014 | 5:36:24 AM
Re: Bigger Heartbleed problem
The Heartbleed bug is making headlines people!

CNN Money reported yesterday that a teenager (19 year old) was able to exploit the Heartbleed bug to hack into Canada's tax agency, the Canada Revenue Agency.

Major websites like Facebook and Tumblr have applied the necessary patches but mobile devices (smartphones) still remain unsafe. Android and iOS users can secure online privacy and internet freedom (until the patches/upgrades come out) by using VPNs to tunnel and encrypt their data. Heartbleed is Causing Damage & You Need to Protect Yourself.  
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/21/2014 | 1:33:43 PM
Bigger Heartbleed problem
This is exactly what experts have been worried about--cyberspies or cybercriminals using Heartbleed for targeted attacks against an organization via their OpenSSL-based VPN. This and Heartbleed attacks against internal SSL servers are perhaps the most devastating possible outcomes.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.