Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Identity & Access

Check Point VPNs Targeted to Hack Enterprise Networks

Check Point is warning customers that threat actors are targeting insecure VPN instances for initial access to enterprise networks. 

Cybersecurity firm Check Point is advising customers to review their VPN configurations to ensure that they cannot be abused by threat actors for initial access to enterprise networks.

Check Point says it has seen VPNs from various cybersecurity vendors being targeted by threat actors. 

The company has been monitoring attempts to gain access to customers’ VPNs and identified “a small number of login attempts” that leveraged old VPN local accounts with password-only authentication. The attacks do not appear to involve the exploitation of a software vulnerability.

“We have assembled special teams of Incident Response, Research, Technical Services and Products professionals which thoroughly explored those and any other potential related attempts,” the company said in an alert on Monday.

“Relying on these customer notifications and Check Point’s analysis, the teams found within 24 hours a few potential customers which were subject to similar attempts,” it added. 

Check Point has instructed customers not to rely on password-only authentication for remotely accessing their networks. 

The vendor has advised organizations to review the use of local accounts and disable them if not needed. If they are needed, authentication should be made more secure, for instance, by adding an additional layer of authentication on top of passwords, such as certificates. 

Check Point VPN users should deploy the product on security gateways to prevent unauthorized access through password-only authentication.

Advertisement. Scroll to continue reading.

The company has provided a script that enables users to easily discover local accounts with password-only authentication, as well as a hotfix to block local accounts from authenticating with only a password.

Check Point has also provided general recommendations for improving an organization’s VPN security posture, and outlined instructions for investigating suspicious activity. 

Related: New ‘TunnelVision’ Technique Leaks Traffic From Any VPN System

Related: Cisco: Multiple VPN, SSH Services Targeted in Mass Brute-Force Attacks

Related: Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.

Register

People on the Move

Retired U.S. Army General and former NSA Director Paul M. Nakasone has joined the Board of Directors at OpenAI.

Jill Passalacqua has been appointed Chief Legal Officer at autonomous security solutions provider Horizon3.ai.

Cisco has appointed Sean Duca as CISO and Practice Leader for the APJC region.

More People On The Move

Expert Insights