1

I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security. I have encountered one which seems odd and would like to know the potential rationale.

When offsite, employees must connect to a remote desktop to access site-specific files and databases. To do this, I connect to a remote access site, after which I can remote connect to my machine. However, after connecting to the site, all internet connections are lost (except of course my connection to the remote desktop). This is supremely annoying, and not something I've experienced working at other similar sites.

My question is, what is the rationale for restricting my internet access while connected to a remote machine? What sort of attacks could this prevent?

2
  • 2
    It looks like a configuration issue. When connecting to the VPN, you should be able to tell your machine to only route the traffic related to the company's network through the VPN, instead of routing all your internet traffic which ends up going to nowhere because the VPN server isn't configured to give you an internet connection (maybe the network you're VPNing into isn't connected to the internet?). Jan 13 '16 at 9:07
  • @André Borie It not a configuration "issue", it is a configuration decision. His employer has opted to disallow split tunneling.
    – k1DBLITZ
    Jan 14 '16 at 14:50
3

One of the primary concerns to limiting Internet access revolves around downloadable threats.

  • Malware that may be part of a botnet.

  • Viruses

  • Rootkits

  • etc..

These threats can obviously compromise security and is a common methodology used by attackers to gain entry to an environment.

If you get an agent based executable installed to your workstation that reports back to a central command and control mechanism it can be told to download keystroke loggers, remote access tools and other nefarious software that once installed can be used to further compromise the local infrastructure your machine is located in. Your machine would be seen a beachead, if you will, for an attacker to get a toehold in your environment to further exploit other infrastructure that is available to you, the private user of the infrastructure.

3
  • 2
    But wouldn't the key logger be able to store key strokes and just wait to send them? I always assumed these didn't send a live stream, but rather sent batches. Perhaps though I am not familiar with this type of malware
    – wnnmaw
    Jan 12 '16 at 19:41
  • It's more preventative measures that your organization is taking. Once you have a keylogger installed, that's a different story. I'm sure some keyloggers will store and send and others will need to send immediately. It would depend on what the software developer created or the attacker purchased to do the work of logging keystrokes.
    – Citizen
    Jan 12 '16 at 19:43
  • @wnnmaw It order for malware on your in-office machine to use your connecting-from-home-machine to communicate with the internet it would likely need for there to be some mechanism (basically meaning another instance of malware item, of some kind) to be in existence on your connecting PC that could store whatever information it wanted to send to someplace on the internet until the connecting PC dropped the VPN-into-work session and regained normal access to the internet. There would need to be something on that PC to act in a "store-and-forward" role for the malware's communications. Jan 13 '16 at 15:01
3

When you connect to your company's "remote access site", your computer is launching a Virtual Private Network (VPN) connection. This first installs a virtual network adapter called a 'tunnel' which is then configured to securely connect to your company's VPN server; at the company server, the other end of the tunnel emits your packets onto the corporate network. It then is changing the settings on your network adapters to route all network traffic to the tunnel interface**. This routing change means all traffic to and from your machine is routed through the company's network. This helps prevent your box from being used as a real-time relay to infiltrate or exfiltrate data, or to act as a remote control device for a hacker.

One of the side effects of using a VPN tunnel is that your packets on the corporate network have a different IP address than they do when you're connected locally. The VPN server uses Network Address Translation (NAT) to make your packets appear inside the network. Because the packets have an IP address associated with the VPN product, they are recognizable to all your network devices as having come from the VPN. That means the company's firewalls can recognize traffic originating from the VPN tunnel and can separate it from ordinary network traffic, and they can apply different rules to it.

If they allow web surfing on the machine while you're locally on the network, but not when the same machine is connected to the VPN, the firewall most likely has different rules for VPN traffic.

If you'll indulge me in some speculation, I can picture a scenario that might be taking place at your shop. Companies that provide network access to contractors or vendors often do not allow them web access for various reasons. The company may lack control over the contractor's computer, meaning the company may not be able to guarantee the contractor machines adhere to company security standards, such as having correct antivirus systems installed. Or they may be preventing the contractors from consuming a lot of bandwidth. Or they may be afraid of a contractor's machine connecting to a rogue web page that could perform a relay attack. And your company may identify your contractor's systems by assigning them IP addresses from a specific range, allowing them to write contractor specific rules in the firewalls.

Now, if there is only a single VPN used by both employees and contractors alike, there would be no way for the firewall to distinguish IP packets coming from the VPN that came from contractor computers vs. those of employee computers. So they may be applying the contractor rules to all VPN traffic. This would ensure the continued compliance of the contractors (important for auditors,) while causing an inconvenience to employees. Most companies do a better job of configuring their VPNs and firewalls than that, but anything's possible. It may even have been done on a recommendation from a security auditor.

For solutions, check with your company's help desk first. If your company offers a non-transparent web proxy for employee computers, you could ask to have your browser's options reconfigured to use the proxy. But don't just change things on your own; you might run afoul of corporate security policies.

** You can see this by opening a command line and typing "route print", and noting which traffic is being directed to which interface; you can also compare the output of that to the output run at a time when you're not connected to the company network.

2

What you are referring to is a split tunneling. Split tunneling allows you to directly access the internet from your device, while the device has the VPN connected to the remote location.

There are a number of pro's and con's to split tunneling - in terms of security and other logistics. See http://www.gfi.com/blog/to-split-or-not-to-split-that-is-the-question/ for a good read on this subject.

1
  • 1
    It would be better if you included a few key facts from the article in your answer. Jan 12 '16 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.