No post body was provided.
Vulnerabilities exploited in VPN products used worldwide
91–100 of 140 posts
Re: Vulnerabilities exploited in VPN products used worldwide
#92Earlier quoted context omitted.
From my experience corporate VPNs exist to allow employees to access internal resources remotely. They aren't typically used for security although they can provide some form of security for remote workers.
Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine , not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often t…
Some protocols/services are designed with a local network in mind and would require modifications to work on the internet. A VPN is invisible to the apps and can easily save a lot of work in a large IT environment with numerous internal services.
Re: Vulnerabilities exploited in VPN products used worldwide
#93Earlier quoted context omitted.
Honestly, isn’t 90% of compliance like that? Checking boxes...
The thing is, people are very good at checking boxes, and not very good at remembering important things. So while it may seem inane, plain old checking boxes is almost certainly part of a good strategy for dealing with tedious, repetitive tasks where one error can cause serious issues - and this kind of security is probably one of those. Obviously, it's not enough, nor an excuse to turn off your brain - but it's a pr…
Flying is a great example of 'checking boxes' saving lives.
Re: Vulnerabilities exploited in VPN products used worldwide
#94Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented. Companies that do BeyondCorp dont even have that level of protection. Most blindly follow that, without realizing that security of their internal systems is bad and therefore they should not do BeyondCorp. I have seen companies put their production infra without any fire walling ou…
BeyondCorp isn't incompatible with VPN solutions -- if anything they're highly complementary. Why not use both?
Exactly my point, Zero Trust is good strategy and mindset. BeyondCorp though is short sighted and seems more like a solution from a company that wants to sell its cloud sooutions, by trying to make VPN evil by suggesting you should not have a network perimeter at all:
"Connecting from a particular network must not determine which services you can access."
I argue, that a simple source IP check is still one of the most significant and effective defense in depth measures that can be put in place. Not doing it seems like lack of due diligence to me. Its the first level of defense to which more security needs to be added on to.
Re: Vulnerabilities exploited in VPN products used worldwide
#95Earlier quoted context omitted.
No. Open source has a precise defition that is equivalent with Free Software: [1] https://opensource.org/osd-annotated [2] https://en.m.wikipedia.org/wiki/Open_source
It's not equivalent with Free Software. Free Software has stricter requirements.
What are the stricter requirements?
Re: Vulnerabilities exploited in VPN products used worldwide
#96Earlier quoted context omitted.
Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine , not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often t…
Some protocols/services are designed with a local network in mind and would require modifications to work on the internet. A VPN is invisible to the apps and can easily save a lot of work in a large IT environment with numerous internal services.
How is a local network different from the internet, presuming there is no firewall or nat between the client and the server ?
Re: Vulnerabilities exploited in VPN products used worldwide
#97Earlier quoted context omitted.
Honestly, isn’t 90% of compliance like that? Checking boxes...
The thing is, people are very good at checking boxes, and not very good at remembering important things. So while it may seem inane, plain old checking boxes is almost certainly part of a good strategy for dealing with tedious, repetitive tasks where one error can cause serious issues - and this kind of security is probably one of those. Obviously, it's not enough, nor an excuse to turn off your brain - but it's a pr…
[deleted]
Re: Vulnerabilities exploited in VPN products used worldwide
#98Earlier quoted context omitted.
Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine , not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often t…
You're ignoring the reality that most enterprise software is a tire fire (from a security standpoint) and that it's not feasible to secure hundreds (or even dozens!) of enterprise apps. VPN's are the enabler that ensures status quo remains.
Can you propose an alternative solution?
Re: Vulnerabilities exploited in VPN products used worldwide
#99Earlier quoted context omitted.
> If you look at the list of vulnerabilities If you look at THIS list of vulnerabilities, sure. That's not an exhaustive list of every problem standard VPNs have had though, you understand that right? > So what value is Wireguard providing, exactly? Even ignoring vulnerabilities entirely, OpenVPN and the like are full of footguns and are very, very easy to fuck yourself with. You talk about the value of practicality…
I'm not defending SSL-based VPN servers. They exist because people didn't understand how IPSec IKE worked or want to put in the effort to make it work better, and as is typical in the industry worse-is-better won the day. But the value those SSL-based and similar bespoke VPN servers brought was automated key management, end-user based authentication, route setup, etc. They've done so horribly in terms of correctness…
I think the value in WireGuard is that by making things simple enough, you can do the "hard" parts manually, and thus don't need all this fragile machinery around it.
Re: Vulnerabilities exploited in VPN products used worldwide
#100Earlier quoted context omitted.
Some protocols/services are designed with a local network in mind and would require modifications to work on the internet. A VPN is invisible to the apps and can easily save a lot of work in a large IT environment with numerous internal services.
How is a local network different from the internet, presuming there is no firewall or nat between the client and the server ?
On a local network, you make the assumption that there are only authorized users.