8 ms·

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked

I'm sure it's been said before, but I just continue to be surprised that the admin panel used to carry out this attack wasn't locked behind a VPN. I've worked for multiple fully-remote companies that were easily able to protect tools like this from the outside world. The company I currently work for (fully remote) has tons of internal services that our engineers (who we trust) can access as needed in order to debug problems and help our clients. None of it is accessible from the Internet.

xyst 6y ago
Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.
- danans 6y ago
  > Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. I could be wrong, but I think they mean that access to the internal site should have been behind VPN (whether at the IP network level or via an HTTP proxy) even when accessed over the internal network. That is, the internal network should not be trusted any more than the network at the cafe down the street.
- w7 6y ago
  Does it though? Using a VPN for access to internal infrastructure doesn't mean said internal infrastructure is insecure or authless itself. As in, defense in layers.
  - hnzix 6y ago
    Exactly, assume zero trust but VPN with MFA provides another layer of security. Given the weekly volume of package vulns Github notifies me about I don't want to miss a 0day and get scanned. Perimeterless is fine if you're only using SaaS or you have an army of SecOps, but I don't want an internal app rumbled.
    - VectorLock 6y ago
      Is a VPN a suitable replacement for good security hygiene and vulnerability management?
      - hnzix 6y ago
        Nobody is saying VPN is a replacement. Users should still have to authenticate against an IDP once they're inside the perimeter. VPN + MFA protects apps from drive-by attacks while they're waiting to be patched. Yes, in a perfect world everyone would have an army of SecOps ninjas pentesting and patching all systems 24/7, but this is the Real World™ Defence in depth.
- gsich 6y ago
  Nobody does that.
- adrr 6y ago
  Who says its an antipattern? VPN Authentication is additional to authentication on internal systems. VPN is a requirement in most security frameworks like NIST.
- ReganLaitila 6y ago
  I would be curious as to who is citing that using a vpn is some "anti-pattern", to what? Not protecting your network accessible assets? If you have the means, certainly use a corporate/smb/personal vpn. It is one layer in a multitude of layers you should be using to protect your network. Its not as if once you achieve vpn access you have no other authz gates to internal applications. Its a "great filter" to help narrow the possible avenues of attack and it works. If your inner layer of authz fails its not the vpn's fault. Whats your alternative? Just make every application and network endpoint publicly accessibly on the internet?
  - greggman3 6y ago
    https://www.beyondcorp.com/ https://www.beyondcorp.com/ Yes, basically you should consider all networks untrusted including your internal network. You can still have a VPN but it shouldn't be the thing that protects the services inside your corp net because if it is then any breach means the intruder gets access to all your stuff.
    - peterlk 6y ago
      This thread is a bit confusing to me. Have we moved past layered security for some reason? The purpose of a VPN was never supposed to be the authentication layer to internal services. It's just a layer of security that makes it more difficult to carry out some types of attacks; thus increasing security defenses of an organization. Assuming that it has been breached is good practice, but doesn't mean that there's no point to it.... Unless layered security has been overturned?
      - judge2020 6y ago
        The issue is that, for any company without thousands of employees (heck, probably even some of these are guilty), the VPN is often the only barrier to the entire network. The BeyondCorp model makes you explicitly specify "John can access support.corp.com but not admin.corp.com", while setting up these explicit checks is the exception for VPN-based access, not the norm (and sometimes it isn't even done right - eg. relying on DNS filtering).
- jen20 6y ago
  > Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. "Defense in depth" is not an anti-pattern. Using an VPN as the only layer is, certainly, but that is a straw man.
- raverbashing 6y ago
  Of course not > If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. No. Logging in the VPN is one thing, logging into the internal systems requires an extra login This is not hard
- hvidgaard 6y ago
  The rhetoric of this statement is far more of an "anti-pattern" than VPN will ever be. If VPN is your only line of defense, then it's not secure at all - not because of VPN, but because of poor security practices in general. VPN and IP restrictions in general is a very good tool to limit the attack surface. That does not mean that Karen from accounting should be able to log into the production environment servers.
  - bonestamp2 6y ago
    Exactly. We have application level authentication on top of various network level security policies. Karen from accounting can't even see servers that she doesn't need, and anything she does need has additional authentication requirements. Even if someone mistakenly gave her access to something at one of these layers, she would need that same mistake at multiple layers to actually get in.
- kochthesecond 6y ago
  VPN gives a little extra layer against vulnerabilities in any packages your internal services depend on.
- trabant00 6y ago
  > Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. How do you jump from "VPN is not authorization" to "VPN is an anti-patern"? It's at a completely different layer than authorization ffs! You don't give up on seat-belts because they don't stop bullets coming through the windshield.
- dna_polymerase 6y ago
  > is considered an anti-pattern now in terms of security. By whom? It's another layer of security, nobody claimed it should be the sole defense.
- Aperocky 6y ago
  It's not an anti-pattern though. It's a part of security, along with other multi-faceted authentication routes.
Thorrez 6y ago
How do you know it wasn't behind a VPN?
- vikasg 6y ago
  They don't know. Like half of all HN comments it's just speculation disguised as a fact.
sneak 6y ago
Web authentication technology (eg U2F) is much more advanced and safe than VPN authentication technology (key files or strings sitting unencrypted on disk). Additionally, TLS1.3 is better than most VPNs from a cryptographic standpoint.
imhoguy 6y ago
This could be even some malcious browser extension running on one highly privileged employee computer. Security is arms race and tradeoffs game, even computers never connected to the Internet are at risk (see Stuxnet story)
blauditore 6y ago
Using VPN as a layer of security is basically like 2FA, where the second factor are credentials to enter the VPN. Wouldn't it be easier to just have any other additional factor, like a physical security key, or some (additional) authenticator mobile app?
- donkeyd 6y ago
  Entering a VPN is usually multi factor by default, because you need both a certificate and a login. Also, there's often a token as a third factor. So you're adding many more levels of security that way.

xyst 6y ago

Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. This hack probably underscores the importance of zero trust. Although if the system is compromised from within (like this hack is) then there is not much you can do.

danans 6y ago
> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. I could be wrong, but I think they mean that access to the internal site should have been behind VPN (whether at the IP network level or via an HTTP proxy) even when accessed over the internal network. That is, the internal network should not be trusted any more than the network at the cafe down the street.
w7 6y ago
Does it though? Using a VPN for access to internal infrastructure doesn't mean said internal infrastructure is insecure or authless itself. As in, defense in layers.
- hnzix 6y ago
  Exactly, assume zero trust but VPN with MFA provides another layer of security. Given the weekly volume of package vulns Github notifies me about I don't want to miss a 0day and get scanned. Perimeterless is fine if you're only using SaaS or you have an army of SecOps, but I don't want an internal app rumbled.
  - VectorLock 6y ago
    Is a VPN a suitable replacement for good security hygiene and vulnerability management?
    - hnzix 6y ago
      Nobody is saying VPN is a replacement. Users should still have to authenticate against an IDP once they're inside the perimeter. VPN + MFA protects apps from drive-by attacks while they're waiting to be patched. Yes, in a perfect world everyone would have an army of SecOps ninjas pentesting and patching all systems 24/7, but this is the Real World™ Defence in depth.
gsich 6y ago
Nobody does that.
adrr 6y ago
Who says its an antipattern? VPN Authentication is additional to authentication on internal systems. VPN is a requirement in most security frameworks like NIST.
ReganLaitila 6y ago
I would be curious as to who is citing that using a vpn is some "anti-pattern", to what? Not protecting your network accessible assets? If you have the means, certainly use a corporate/smb/personal vpn. It is one layer in a multitude of layers you should be using to protect your network. Its not as if once you achieve vpn access you have no other authz gates to internal applications. Its a "great filter" to help narrow the possible avenues of attack and it works. If your inner layer of authz fails its not the vpn's fault. Whats your alternative? Just make every application and network endpoint publicly accessibly on the internet?
- greggman3 6y ago
  https://www.beyondcorp.com/ https://www.beyondcorp.com/ Yes, basically you should consider all networks untrusted including your internal network. You can still have a VPN but it shouldn't be the thing that protects the services inside your corp net because if it is then any breach means the intruder gets access to all your stuff.
  - peterlk 6y ago
    This thread is a bit confusing to me. Have we moved past layered security for some reason? The purpose of a VPN was never supposed to be the authentication layer to internal services. It's just a layer of security that makes it more difficult to carry out some types of attacks; thus increasing security defenses of an organization. Assuming that it has been breached is good practice, but doesn't mean that there's no point to it.... Unless layered security has been overturned?
    - judge2020 6y ago
      The issue is that, for any company without thousands of employees (heck, probably even some of these are guilty), the VPN is often the only barrier to the entire network. The BeyondCorp model makes you explicitly specify "John can access support.corp.com but not admin.corp.com", while setting up these explicit checks is the exception for VPN-based access, not the norm (and sometimes it isn't even done right - eg. relying on DNS filtering).
jen20 6y ago
> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. "Defense in depth" is not an anti-pattern. Using an VPN as the only layer is, certainly, but that is a straw man.
raverbashing 6y ago
Of course not > If the account with VPN access is compromised, then the attacker has full access to these sensitive systems. No. Logging in the VPN is one thing, logging into the internal systems requires an extra login This is not hard
hvidgaard 6y ago
The rhetoric of this statement is far more of an "anti-pattern" than VPN will ever be. If VPN is your only line of defense, then it's not secure at all - not because of VPN, but because of poor security practices in general. VPN and IP restrictions in general is a very good tool to limit the attack surface. That does not mean that Karen from accounting should be able to log into the production environment servers.
- bonestamp2 6y ago
  Exactly. We have application level authentication on top of various network level security policies. Karen from accounting can't even see servers that she doesn't need, and anything she does need has additional authentication requirements. Even if someone mistakenly gave her access to something at one of these layers, she would need that same mistake at multiple layers to actually get in.
kochthesecond 6y ago
VPN gives a little extra layer against vulnerabilities in any packages your internal services depend on.
trabant00 6y ago
> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN. How do you jump from "VPN is not authorization" to "VPN is an anti-patern"? It's at a completely different layer than authorization ffs! You don't give up on seat-belts because they don't stop bullets coming through the windshield.
dna_polymerase 6y ago
> is considered an anti-pattern now in terms of security. By whom? It's another layer of security, nobody claimed it should be the sole defense.
Aperocky 6y ago
It's not an anti-pattern though. It's a part of security, along with other multi-faceted authentication routes.

Thorrez 6y ago

How do you know it wasn't behind a VPN?

vikasg 6y ago
They don't know. Like half of all HN comments it's just speculation disguised as a fact.

sneak 6y ago

Web authentication technology (eg U2F) is much more advanced and safe than VPN authentication technology (key files or strings sitting unencrypted on disk). Additionally, TLS1.3 is better than most VPNs from a cryptographic standpoint.

imhoguy 6y ago

This could be even some malcious browser extension running on one highly privileged employee computer. Security is arms race and tradeoffs game, even computers never connected to the Internet are at risk (see Stuxnet story)

blauditore 6y ago

Using VPN as a layer of security is basically like 2FA, where the second factor are credentials to enter the VPN. Wouldn't it be easier to just have any other additional factor, like a physical security key, or some (additional) authenticator mobile app?

donkeyd 6y ago
Entering a VPN is usually multi factor by default, because you need both a certificate and a login. Also, there's often a token as a third factor. So you're adding many more levels of security that way.