Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Evasion of Security Policies by VPN Clients Poses Great Risk to Network Operators

Summary: Palo Alto Networks Unit 42 analyzed the VPN client X-VPN and found it uses custom encryption of TCP and UDP payloads and mimics HTTP, SSL, FTP, NTP, and SMTP traffic to evade security and policy enforcement. The researchers estimate X-VPN runs about 10,000 server instances on public cloud providers and swaps 300-500 of them for new public IP addresses every day, with traffic disguised as connections to sites such as google.com, bing.com, and icloud.com.

Why it matters: Because protection systems cannot inspect the disguised packets, malicious traffic can enter the network or sensitive data can leave it - and with 300-500 server IPs rotating daily, blocklists built on those addresses go stale within a day.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related