If you have a business and your employees use VPNs from Fortinet, Palo Alto , or Pulse Secure, you should definitely patch your products and check systems .
As it became known in September, a group of hackers from China, nicknamed APT5, carried out attacks on corporate VPN servers using Fortinet and Pulse Secure products.
The actions of this group have been made public, but no one can be sure that there is no other similar group that will attempt to exploit the vulnerabilities. The UK’s National Cybersecurity Centre (NCSC) is warning organisations that Palo’s GlobalProtect portal and GlobalProtect Gateway interface are also being targeted by hackers. These attacks are still ongoing and target not only UK but also international organisations such as government, military, academic, business and healthcare organisations.
The NCSC has released the 6 biggest vulnerabilities exploited by hacking in VPN products. Patches for each of the vulnerabilities are also available and it is recommended that admins be notified immediately to avoid compromises, as the attackers' code is available online.
VPN flaws would allow hackers to obtain credentials that can be used to connect to the VPN and change settings.
- The vulnerabilities affecting Pulse Connect Secure VPN are CVE-2019-11510 and CVE-2019-11539.
- The vulnerabilities affecting Fortinet's Fortigate devices are CVE-2018-13379, CVE-2018-13382 and CVE-2018-13383.
- Both the GlobalProtect portal and the GlobalProtect Gateway interface of Palo are CVE-2019-1579.
The NCSC recommends that organizations that have been targeted by state-sponsored hackers check all settings and log files for services that users connect to via VPN.
It also recommends that devices be wiped clean if they have been previously attacked. Additionally, organizations should implement two-factor authentication for VPNs and disable unnecessary features and ports in the VPN.
