[TheRecord] NSA, CISA publish guide for securing VPN servers

The National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have published today technical guidance on properly securing VPN servers used by organizations to allow employees remote access to internal networks.

The NSA said it put together the nine-page guide [PDF] after “multiple nation-state advanced persistent threat (APT) actors” weaponized vulnerabilities in common VPN servers as a way to breach organizations.

“Exploitation of these CVEs [vulnerabilities] can enable a malicious actor to steal credentials, remotely execute code, weaken encrypted traffic’s cryptography, hijack encrypted traffic sessions, and read sensitive data from the device,” the NSA said today in a press release announcing the guide’s publication.

“If successful, these effects usually lead to further malicious access and could result in a large-scale compromise to the corporate network,” the agency added.

For example, Chinese, Iranian, and Russian state-sponsored groups have been spotted abusing vulnerabilities in Pulse Secure and Fortinet VPNs in campaigns that have taken place between 2019 and 2021.

Ransomware gangs such as Conti, Ryuk, REvil, DoppelPaymer, LockBit, and several others have also been spotted using VPN servers as their entry points into organizations before escalating access to internal networks and launching their file-encrypting attacks. Furthermore, cryptomining botnets have also abused VPN servers as a way to enter corporate networks and then compromise internal systems with hidden cryptocurrency mining software that exhausts computing resources for the attackers’ financial profits.

“Exploiting remote access VPNs can become a gateway to large-scale compromise,” Rob Joyce, Director of Cybersecurity at NSA, told The Record.

“We created guidance to help organizations understand what to look for when choosing VPNs and how to configure them to reduce the risk of being exploited. Use these recommendations to verify any VPNs are securely configured.”

VPN servers are entry points into protected networks, making them attractive targets. APT actors have and will exploit VPNs – the latest guidance from NSA and @CISAgov can help shrink your attack surface. Invest in your own protection! https://t.co/npBc8Sh9A4

— Rob Joyce (@NSA_CSDirector) September 28, 2021

The guide, which is expected to receive updates in the future as new issues and recommendations are discovered, contains advice on the following topics:

Considerations for selecting remote access VPNsDirections on configuring strong cryptography and authentication Advice on reducing the VPN’s attack surface by running only strictly necessary features Guidance on protecting and monitoring access to and from the VPN

Today’s guidance release comes after the two agencies also released another joint guide on hardening the security of Kubernetes clusters last month, in August 2021.

The post NSA, CISA publish guide for securing VPN servers appeared first on The Record by Recorded Future.

Source: Read More (The Record by Recorded Future)

You might be interested in …

[BleepingComputer] Chrome now automatically fixes breached passwords on Android

Google is rolling out a new Chrome on Android feature to help users change passwords leaked online following data breaches with a single tap. […] Source: Read More (BleepingComputer)

Read More

[BleepingComputer] Cybercriminal sells tool to hide malware in AMD, NVIDIA GPUs

Cybercriminals are making strides towards attacks with malware that executes code from the graphics processing unit (GPU) of a compromised system. […] Source: Read More (BleepingComputer)

Read More

[HackerNews] Crackonosh virus mined $2 million of Monero from 222,000 hacked computers

All posts, HackerNews

A previously undocumented Windows malware has infected over 222,000 systems worldwide since at least June 2018, yielding its developer no less than 9,000 Moneros ($2 million) in illegal profits. Dubbed “Crackonosh,” the malware is distributed via illegal, cracked copies of popular software, only to disable antivirus programs installed in the machine and install a coin […]

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.