Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I am connecting to a VPN server that has been compromised and is under the complete control of an attacker. The virtual network itself contains numerous attackers waiting for a new target. What steps should be taken to protect myself in this hostile environment?

(Yes, I have to use a VPN that is the point of the question.)

share|improve this question
6  
It would help if you added some more context to the question, as you have done in some of your comments below. What is your goal? What assets are you protecting? Is this a "capture-the-flag" sort of scenario? – nealmcb Jul 13 '11 at 14:14
4  
@Rook - Accept the fact that people with a lot of experience are providing answers to help you, and stop being abusive. It may not be the answer you expected, but I think enough people here who do this for a living agree on it that you should perhaps reserve your judgement and just listen rather than get abusive! You have been warned enough times already. – Rory Alsop♦ Jul 13 '11 at 21:02

4 Answers

up vote 6 down vote accepted

I don't get what makes the VPN different from the Internet. You can treat it with the same suspicion.

For Windows, that probably means selecting the park bench and get hacked anyway. In Linux, it means you do regular updates and run only the services that you need, plus double-checking their configuration.

If you consider the VPN as such a highly hostile environment that they will be running targeted attacks against your client, there is little you can do without yourself being an expert or paying an expert to review your configuration. In addition to the issues mentioned above, you should probably run a BSD kernel and don't use applications like complex web browsers or email clients at all, due to their very high security bug rates (see here for some approximate stats: http://www.virtuallysecure.org/blog/display?id=41)

share|improve this answer
up vote 8 down vote

Just don't use the VPN. Honestly.

If there is a reason why you want to use that VPN you can do the same as for normal network.

  • Firewall
  • Anti-Virus
  • Use sandbox like virtual machines
  • Keep uptodate of your software and OS
  • Maintain maximum network isolation in order not to compromise other computers.
share|improve this answer
3  
I think @M'vy has the right idea - ideally, you don't use it as you already know it is malicious...but if you must, ensure all the usual hardening processes have been used to protect your machine. I would really recommend VM's as a must. – Rory Alsop♦ Jul 12 '11 at 19:16
2  
@Rook, @M'vy did answer the question: "you can do the same as for a normal network" etc. – D.W. Jul 12 '11 at 23:09
3  
@Rook - I didn't say 'let it get hacked' - I kinda said the opposite, as did @M'vy, and indeed @pepe – Rory Alsop♦ Jul 13 '11 at 0:12
1  
@Rook: If VM does not help, you should start out by using a different architecture. x86 is fundamentally vulnerable to attacks against the hypervisor or even TXT/SVM. Having that different architecture, you can use a BSD system as the most convenient/usable solution. But then be aware of the highly vulnerable userspace. I don't think this is the right place and approach to discuss this. You need a proper adversary and system model and then start a design and review process. If you are lucky, you can then start the implementation in half a year and never get finished. – pepe Jul 13 '11 at 12:59
1  
@Rook RE: "It's already a VM, that doesn't help." - Mind including that in the OP? You can't possibly expect us to compose our answers with that in mind, when it wasn't included in the question to begin with. – Iszi Jul 13 '11 at 13:18
show 2 more comments
up vote 8 down vote

I'm with @M'vy - Don't use the VPN. For that matter, don't connect to the compromised network at all by any means. Contact the appropriate help desk, network administrator, and/or incident response team and advise them of the situation. Don't plug into the network or connect via VPN until they've neutralized the threat to the best of their abilities, and given the "all clear".

If, for whatever crazy reason, you absolutely must connect to the compromised network, do so from a system booted to non-writable LiveCD. Additionally, make sure all non-disposable, writable media (including internal HDDs) have been physically disconnected from your system. Last, make sure you do not transfer any sensitive information across the compromised network unless absolutely necessary.

share|improve this answer
up vote 7 down vote

What you are doing is really just like connecting to untrusted lan environment.

If what you are doing things like wargames and the rest, what I've always done is run a hardened unix virtual machine and connect from there. Of course you need to get the networking right - the virtual machine must not have network access to your host but an interface linked to your router must exist so that you have internet. Also running a firewall limiting and monitoring the vpn interface both ways is essential.

Having done that, it then depends on what you want to do in that hostile environment - what are you trying to protect against and what are your 'valuables' in the vm that could be accessed.

share|improve this answer
+1 - It is just another untrusted environment. Nice additional info to @Iszy's, @pepe's and @M'vy's posts. – Rory Alsop♦ Jul 13 '11 at 7:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.