Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/21/2019
09:00 AM
50%
50%

7 Ways VPNs Can Turn from Ally to Threat

VPNs are critical pieces of the security infrastructure, but they can be vulnerable, hackable, and weaponized against you. Here are seven things to be aware of before you ignore your VPN.
Previous
1 of 8
Next

VPNs are critical pieces of the enterprise cybersecurity infrastructure. When it comes to protecting data in motion, there's really no good substitute. And that's why it can be so devastating to learn that this mandatory tool can carry vulnerabilities.

Before going any further, it's important to note that nothing here is intended to suggest that your organization ditch its VPNs. Networking with VPNs is vastly more secure than networking without them. With that said, there's no part of the enterprise IT infrastructure that qualifies as "set it and forget it," and VPNs are not exceptions to this rule.

The dangers represented in this article fall into two broad categories; first are the vulnerabilities that are "designed in," featuring problems with the logic, installation, or basic features of the VPN's client or server.

Vulnerabilities in the second group are "classic" vulnerabilities — inadvertent errors in the code running on one side or other of the VPN, an issue with how a protocol is implemented, or something similar.

A number of the vulnerabilities listed in this article have been patched in recent versions of the software, illustrating once again the importance of keeping software updated and fully patched. More than that, the vulnerabilities listed here are a reminder that cybersecurity means looking at every piece of the IT infrastructure, whether it's provided by the business or brought in by the employee. That goes for services as much as for products, and for security services as much as personal productivity applications.

(Image: Bits and Splits via Adobe Stock)

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Poll Results: Maybe Not Burned Out, but Definitely 'Well Done'."

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Moral_Monster
50%
50%
Moral_Monster,
User Rank: Apprentice
9/22/2019 | 6:47:18 AM
VPN Risks

In most cases I tend to think that the problem is that loose nut behind the keyboard, But each of these are problems that land right in the lap of IT. But is there a site that will give you the straight poop on the different VPN Providers? Until you develop a relationship with your provider the sales weasels will be quick to tell you "Sure we do. Everything is fine.".

repogos
50%
50%
repogos,
User Rank: Apprentice
9/23/2019 | 6:05:28 AM
with all
does with happen with every vpn and for paid one?
rnolan
100%
0%
rnolan,
User Rank: Apprentice
9/30/2019 | 11:52:04 PM
Re: VPN Risks
I'm a bit bemused why most of these services are called VPNs when they are fundamentally just anonymising services (proxys).  A VPN (used to mean) point to "end" point (end to end encryption).  I supose you could call the eco system on the user side of the proxy a private logical network providing some protection from public WiFi etc.  More worrying is the claims made by companies like Nord that using their service protects your data/privacy etc.  It doesn't offer any protection from the proxy to where you are surfing other than hiding your IP address. Obviously if the site you are accessing is a HTTPS/TLS site this will afford some protection but the "VPN" service advertised doesn't.  Moreover, these services provide a perfect man in the middle opportunity and, depending where they are located (i.e. anywhere in the cloud) no regulatory/legal oversight or protection.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15570
PUBLISHED: 2020-07-06
The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file.
CVE-2020-15569
PUBLISHED: 2020-07-06
PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
CVE-2020-7690
PUBLISHED: 2020-07-06
It's possible to inject JavaScript code via the html method.
CVE-2020-7691
PUBLISHED: 2020-07-06
It's possible to use <<script>script> in order to go over the filtering regex.
CVE-2020-15562
PUBLISHED: 2020-07-06
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.