2

Background

As many others I am working from home and we use a VPN to access services from the company intranet (SMB fileshares, git repo, project management etc). To improve things like video calls I suggested to our IT to enable split tunneling to allow traffic not determined for the company intranet to use the home internet connection directly. However this was rejected with the reason that "split tunneling increases the risk for the company intranet".

I tried to understand the risks that arise from split tunnelling, but besides reading "it increases the risk" I did not really find any concrete explanations how an attacker can leverage the split tunnel.

Question

Give a couple of boundary conditions

  • employee productivity monitoring or blocking certain sites (unless obviously malicious) is not the reason to require a full tunnel.
  • Connecting to the VPN requires a compliance check on the endpoint.
    • but: Despite best-effort compliance checks an endpoint might be infected/insecure (e.g. due to a 0day).
  • employee himself doesn't do something obviously stupid like bridging the internet connection to the VPN connection.
  • Unless requiring services from the intranet endpoints don't use the VPN and use the home internet connection.
  • endpoints are not connected directly to the internet but are behind a NAT.

My question is: What are attack scenarios that an attacker can exploit when using a split tunnel, and how would the full tunnel protect from that?

Edits / additions

  • On what is monitored, inspected, restricted:
    • Terabytes of data flowing out to a suspicious domain might cause raised eyebrowes. But large uploads to popular filesharing sites (e.g. weshare), are normal.
    • No deep packet inspection.
    • certain ports are blocked (such as, no outgoing ssh or SMTP).

isn't the "blocking ... obviously malicious" not already an argument for using the full tunnel?

and

Do you mean by this that the same system which is used with full VPN to access the company, has at other times unrestricted (and unprotected) access to the internet?

Yes, correct. Endpoints can easily visit any site when they disconnect from the VPN, so while they would be protected when using the you cannot rely on that protection.

  • The security gain from prohibiting a split tunnel depends on how internet facing traffic is controlled (i.e. monitored, inspected, restricted). If there are no monitoring, inspection or restrictions then there is no gain. If instead everything is blocked then it is very secure but probably heavily impacting productivity too. Unfortunately this information is missing from your question. One possible problem which might be detected and/or blocked when using a full tunnel is for example C2 communication of local malware. – Steffen Ullrich Nov 16 '20 at 16:40
  • "... blocking certain sites (unless obviously malicious) is not the reason to require a full tunnel" - isn't the "blocking ... obviously malicious" not already an argument for using the full tunnel? Obviously this is to prevent attacks. But how does access to these sites gets blocked when using a split tunnel? – Steffen Ullrich Nov 16 '20 at 16:47
  • 1
    "employee himself doesn't do something obviously stupid like bridging the internet connection to the VPN connection" - nothing stupid need to be done for this. Simply using the browser already can do this. See for example Attacking the internal network from the public Internet using a browser as a proxy. – Steffen Ullrich Nov 16 '20 at 16:50
  • "Unless requiring services from the intranet endpoints don't use the VPN and use the home internet connection." - Do you mean by this that the same system which is used with full VPN to access the company, has at other times unrestricted (and unprotected) access to the internet? – Steffen Ullrich Nov 16 '20 at 16:55
  • Amended the post. Hopefully that should fill the gaps. – Stefan D. Nov 16 '20 at 17:06
2

Since in your specific setup the home office computers are either connected with a full VPN tunnel to the company or have full direct access to the internet (i.e. VPN off), the main point of the VPN is obviously not to protect the computer itself. With such a setup it is still possible that an attacker can compromise the system and establish a permanent presence on it, only to later move further into the companies infrastructure once the full VPN is established.

But a full VPN can make such lateral movement more difficult, in that it might prevent the outside attacker to easily control the compromised system once it is using the VPN. With a split VPN an unfiltered connection to the attacker can be kept while at the same time being connected to the company network. With a full VPN instead only filtered connections to the internet are possible, which ideally prevents access for the attacker. Of course there might still be ways to tunnel the attackers connection but it is more difficult and it is less stealth than before.

Additionally the normal web browser can be used for cross-origin attacks, where one origin is the attacker on the internet and the other the company network. This is because the same browser has access to both networks and can connect to both at the same time, even from within the same web page. This makes for example attacks like CSRF or DNS rebinding possible. See also Attacking the internal network from the public Internet using a browser as a proxy for more such cross-origin attacks.

  • The linked whitepaper mentions though that "neither a hostbased firewall nor a perimeter firewall is enough to fully prevent remote exploitation". If I understand it correctly, if no proxy is used in the corporate network that could detect such an attack, this would mean that CSRF attacks are still possible even through a full tunnel, correct? – Stefan D. Nov 18 '20 at 14:29
  • 1
    @StefanD.: CSRF is impossible to detect without content inspection, and even then it is hard. But if the attackers site is known and is blocked (which might also be done without a proxy) then it can still be prevented. Also, already monitoring and logging traffic metadata might help to detect strange behaviors or might help in incident response. With a split VPN such visibility is lost. – Steffen Ullrich Nov 18 '20 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.