I promised to come back to remote access. Here is a look at what happened with VPN and remote access from January to April this year.<\/p>\n
January started with an alert from the US cyber security agency CISA urging everyone to patch a critical vulnerability in Pulse Secure VPN. The patch had been out since April 2019, but attackers were still exploiting unpatched servers, and the vulnerability was linked to ransomware attacks. In August 2019 researchers had found more than 14 500 vulnerable servers. In late March this year there were still about 2 100.<\/p>\n
In parallel, the Citrix gateway vulnerability I wrote about before Christmas was exploited widely during January before the patches arrived.<\/p>\n
Then the lockdowns came. Kaspersky reported that brute force attacks against remote desktop went from the low hundreds of thousands per country and day in early March to almost a million per day in some countries by the end of the month. In the US they peaked at 1.4 million attempts on April 7.<\/p>\n
And in April CISA came back with an important warning: attackers who had stolen passwords through the Pulse Secure vulnerability could still get in after the patch, if the passwords were not changed.<\/p>\n
Patching closes the hole. It doesn\u00b4t throw out the people who already came through it.<\/p>\n","protected":false},"excerpt":{"rendered":"
I promised to come back to remote access. Here is a look at what happened with VPN and remote access from January to April this year. January started with an alert from the US cyber security agency CISA urging everyone to patch a critical vulnerability in Pulse Secure VPN. The patch had been out since […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[67,68,62],"class_list":["post-1210","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-statistics","tag-threat-intelligence","tag-vpn"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1210"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1210\/revisions"}],"predecessor-version":[{"id":1238,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1210\/revisions\/1238"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}