Several malware types have the capability to move laterally within the company infrastructure, infecting connected machines within the company. I was wondering how it's possible for an infected computer (BYOD) that connects to an organization via VPN will be able to infect other computers?

  • 1
    This question is extremely broad and thus unanswerable. You're asking how malware is able to move laterally over a VPN, which cannot be answered unless you provide a significantly larger amount of specifications for your use case. – xorist Oct 5 '18 at 17:21
  • edit is committed – Filipon Oct 5 '18 at 17:51
  • 1
    The edit I made doesn't clarify your use-case, it was just to make it easier for people to understand the question. We are still going to need a lot more information on your specific problem before we can give you a good answer. (e.g., what OSs are on your network? what attack vectors are you concerned about specifically(old software running on open ports? etc.) etc..). – xorist Oct 5 '18 at 17:57
  • I'm confused by your question. You say 1) a machine infected with malware can infect other machines, 2) VPNs connect machines to networks, 3) how is it possible for an infected machine to infect other machines connected over VPN? You answer your own question: over the VPN. I think there is some detail or underlying assumptions missing from your question. – schroeder Oct 6 '18 at 21:38

A real VPN connects a device at the network level into the company's network. Sensitive data will be processed on the local system, similar to a desktop inside the company. Unless additional protections are in place, this kind of setup makes lateral movement for an attacker as easy as lateral movement within the other companies networks. And given that BYOD devices usually spend a lot of time outside the (kind of) well-protected company network this essentially means that this kind of setup should be a nice idea from the point of an attacker and should thus be seen as a very bad idea from the point of the company.

There are several improvements which can be made to increase the security and decrease the risk. One way would be to add a restrictive firewall and an intrusion detection/prevention system between the VPN and the other company network in the hope that the firewall prevents some kind of movement and the IDS/IPS the rest. Verbose logging of network activity would make it possible to at least detect the cause of attacks later - if somebody has the time and knowledge to dig through all those logs. Still, connecting a device which should not be trusted even in a limited way to a sensitive network does not really sound like a good idea, i.e. the risk should still be considered high.

A better option in most cases is probably to not use a "real" VPN at all. Instead use some remote desktop software, where all activity is running on some system inside the company and the local system is essentially just a dumb monitor which shows what happens remote and keyboard and mouse provided limited interaction. This way all data are processed on kind of well-protected systems in the company and sensitive data don't leave the company network. Similar malware on the BYOD device cannot simply move into the company network since the only path into this network are keyboard and mouse activity. There is still a considerable risk with this kind of setup since an attacker might to get access to the remote desktop credentials and thus connect himself to the company network. But it is less risky than a direct VPN connection and use of two-factor authentication can reduce the risk even further (but not fully eliminate it).

Another way would be to not connect an arbitrary device via VPN to the company network but only trusted and company-managed devices, i.e. not BYOD. Of course, it needs to be guaranteed that these devices are not modified by an attacker. But there are ways to protect the integrity of these devices even if they are not inside the company, for example with combining secure boot, encrypted disk and hardware-based authentication (personalized smartcards or similar).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.