Attacks/Breaches
4/21/2014
09:00 AM
Connect Directly
RSS
E-Mail
50%
50%

Heartbleed Attack Targeted Enterprise VPN

Attack spotted using the OpenSSL Heartbleed bug to steal session tokens and bypass two-factor authentication.

Now there's live proof the Heartbleed bug can be exploited, not just to steal private SSL keys stored on a server, but also to retrieve VPN session tokens.

Researchers at Mandiant -- now part of threat intelligence firm FireEye -- on Friday revealed that they spotted a successful VPN-targeting attack that began April 8. That was just one day after OpenSSL issued a public security advisory about a "TLS heartbeat read overrun" in its open-source SSL and TLS implementation. 

The flaw, later dubbed "Heartbleed," was quickly tapped by a VPN-targeting attacker. "The attacker repeatedly sent malformed heartbeat requests to the HTTPS Web server running on the VPN device, which was compiled with a vulnerable version of OpenSSL, to obtain active session tokens for currently authenticated users," said Mandiant technical director Christopher Glyer and senior consultant Chris DiGiamo in a blog post. "With an active session token, the attacker successfully hijacked multiple active user sessions and convinced the VPN concentrator that he/she was legitimately authenticated."

The researchers declined to name the organization that was targeted, but said the attacker's aims didn't appear to be academic. "Once connected to the VPN, the attacker attempted to move laterally and escalate his/her privileges within the victim organization," they said.

But many businesses might not know that attackers could exploit Heartbleed to grab legitimate VPN session tokens, which also allowed the attacker to bypass the organization's two-factor authentication system, as well as a check -- built into the VPN client software -- meant to ensure that prescribed security software was running on the client. "To date, much of the discussion on the Internet has focused on an attacker using the vulnerability to steal private keys from a Web server, and less on the potential for session hijacking," the Mandiant researchers said. 

Even so, a related warning was sounded April 8, when the first proof-of-concept exploit for stealing private SSL keys via the Heartbleed bug was published -- in the form of a Python script -- which led Web application penetration tester Matthew Sullivan to warn about the potential for session-token-stealing attacks to occur. "The currently available proof-of-concept scripts allow any client, anywhere in the world, to perform a session hijacking attack of a logged-in user," he said in a blog post.

Such an attack, Sullivan added, could also bypass the need for an attacker to provide authentication credentials, and could be used against "any Web service that uses cookies to track the session state -- almost every site on the Internet." Furthermore, related attacks might be tough to spot. "The only way to detect this type of attack is to check the source IPs of traffic for each and every request." 

In the case of the VPN exploit detailed by Mandiant, the intrusion apparently came to light after the targeted organization added intrusion detection system (IDS) signatures designed to spot signs of Heartbleed-related exploits on the network. Mandiant said it later verified the intrusion by reviewing both IDS signatures and VPN logs.

With the right IDS signatures in place, this intrusion was apparently tough to miss, with Mandiant noting that the organization's related IDS signature "alerted over 17,000 times during the intrusion," with all alerts pointing to its internal SSL VPN appliance. As that suggests, exploiting the Heartbleed bug to retrieve a legitimate session token or private key may require an extended effort that takes hours to unfold. "In our experience, an attacker will likely send hundreds of attempts because the vulnerability only exposes up to 64KB of data from a random section of memory," said Mandiant.

To guard against Heartbleed attacks -- against VPN systems or otherwise -- Mandiant recommended updating vulnerable VPN systems as soon as possible. To date, many sites have already rushed to patch the Heartbleed bug, although some large vendors have yet to compile definitive lists of all products that are vulnerable or release-related patches.

According to a DarkReading flash poll, as of Friday, 60 percent of respondents said they've installed Heartbleed fixes on servers, although only about 40 percent said they'd replace digital certificates, and just 30 percent planned to force users to change their passwords.

Mandiant also suggested reviewing logs for signs of previous intrusions, which could be indicated by any VPN session in which a session's IP address changed rapidly between two IP addresses -- one of which might be legitimate, and the other controlled by an attacker. "It is common for an IP address to legitimately change during a session, but from our analysis it is fairly uncommon for the IP address to repeatedly change back and forth between IP addresses that are in different network blocks, geographic locations, from different service providers, or rapidly within a short time period."

Finally, Mandiant recommended businesses add IDS signatures designed to spot Heartbleed-related activity. But while such signatures may make VPN session token attacks easy to spot, they won't unearth all types of Heartbleed-related exploits. For example, the "Heartleech" proof-of-concept attack software posted to GitHub last week by Robert David Graham, CEO of Errata Security, is designed to evade detection by Snort IDS rules, while using an "autopwn" process to automate the process of stealing SSL keys. 

"Go away from your computer for many hours, and when you come back, you'll have the key," Graham said. 

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JessicaP494
50%
50%
JessicaP494,
User Rank: Apprentice
7/6/2014 | 1:42:27 AM
get the best vpn service with waselpro
you can surf the internet and blocked websites verey easy with waselprovpn service , you can speed up ypur internet programs , change and hide your ip address , secure your use on the internet , the program work on computers and all kind of mobile devices ,

http://www.bestcheapvpnservice.com/cheap-vpn-solution-for-small-business/
AaronB062
50%
50%
AaronB062,
User Rank: Apprentice
4/25/2014 | 4:16:29 PM
Heartbleed is bad, but session hijacking is not new
Session hijacking is not a new risk, but it is somewhat of a sleeper. It's not likely something that is at the top of the agenda for every organization's security update meeting – but it should be.  In fact, OWASP puts session management collectively with authentication management and lists them as No. 2 in the top 10 vulnerabilities from 2013.  We have been concerned about this vulnerability and have worked with our customers on session management and protection against session hijacking and replay.
AmmarNaeem
50%
50%
AmmarNaeem,
User Rank: Apprentice
4/22/2014 | 5:36:24 AM
Re: Bigger Heartbleed problem
The Heartbleed bug is making headlines people!

CNN Money reported yesterday that a teenager (19 year old) was able to exploit the Heartbleed bug to hack into Canada's tax agency, the Canada Revenue Agency.

Major websites like Facebook and Tumblr have applied the necessary patches but mobile devices (smartphones) still remain unsafe. Android and iOS users can secure online privacy and internet freedom (until the patches/upgrades come out) by using VPNs to tunnel and encrypt their data. Heartbleed is Causing Damage & You Need to Protect Yourself.  
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/21/2014 | 1:33:43 PM
Bigger Heartbleed problem
This is exactly what experts have been worried about--cyberspies or cybercriminals using Heartbleed for targeted attacks against an organization via their OpenSSL-based VPN. This and Heartbleed attacks against internal SSL servers are perhaps the most devastating possible outcomes.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio