Attack scenario when using split tunnel VPN

Question

Background

As many others I am working from home and we use a VPN to access services from the company intranet (SMB fileshares, git repo, project management etc). To improve things like video calls I suggested to our IT to enable split tunneling to allow traffic not determined for the company intranet to use the home internet connection directly. However this was rejected with the reason that "split tunneling increases the risk for the company intranet".

I tried to understand the risks that arise from split tunnelling, but besides reading "it increases the risk" I did not really find any concrete explanations how an attacker can leverage the split tunnel.

Question

Give a couple of boundary conditions

• employee productivity monitoring or blocking certain sites (unless obviously malicious) is not the reason to require a full tunnel.
• Connecting to the VPN requires a compliance check on the endpoint.
  • but: Despite best-effort compliance checks an endpoint might be infected/insecure (e.g. due to a 0day).
• employee himself doesn't do something obviously stupid like bridging the internet connection to the VPN connection.
• Unless requiring services from the intranet endpoints don't use the VPN and use the home internet connection.
• endpoints are not connected directly to the internet but are behind a NAT.

My question is: What are attack scenarios that an attacker can exploit when using a split tunnel, and how would the full tunnel protect from that?

Edits / additions

• On what is monitored, inspected, restricted:
  • Terabytes of data flowing out to a suspicious domain might cause raised eyebrowes. But large uploads to popular filesharing sites (e.g. weshare), are normal.
  • No deep packet inspection.
  • certain ports are blocked (such as, no outgoing ssh or SMTP).

isn't the "blocking ... obviously malicious" not already an argument for using the full tunnel?

and

Do you mean by this that the same system which is used with full VPN to access the company, has at other times unrestricted (and unprotected) access to the internet?

Yes, correct. Endpoints can easily visit any site when they disconnect from the VPN, so while they would be protected when using the you cannot rely on that protection.

Answer 1

Since in your specific setup the home office computers are either connected with a full VPN tunnel to the company or have full direct access to the internet (i.e. VPN off), the main point of the VPN is obviously not to protect the computer itself. With such a setup it is still possible that an attacker can compromise the system and establish a permanent presence on it, only to later move further into the companies infrastructure once the full VPN is established.

But a full VPN can make such lateral movement more difficult, in that it might prevent the outside attacker to easily control the compromised system once it is using the VPN. With a split VPN an unfiltered connection to the attacker can be kept while at the same time being connected to the company network. With a full VPN instead only filtered connections to the internet are possible, which ideally prevents access for the attacker. Of course there might still be ways to tunnel the attackers connection but it is more difficult and it is less stealth than before.

Additionally the normal web browser can be used for cross-origin attacks, where one origin is the attacker on the internet and the other the company network. This is because the same browser has access to both networks and can connect to both at the same time, even from within the same web page. This makes for example attacks like CSRF or DNS rebinding possible. See also Attacking the internal network from the public Internet using a browser as a proxy for more such cross-origin attacks.