Subject: RE: Windows2000 IPSec/L2TP VPN Security Threats

From: "Fox, David" <[email-masked]>
Date: Mon, 13 Nov 2000 08:46:15 -0500

Eliot,
	The answer is that it "depends."  There are two scenarios that I've
heard from customers:

1) They want all access to the corporate and Internet going through the
corporate network and thus through the VPN.  In the case of the Internet
access, the traffic would then go through the corporate firewall.  That
traffic can then be tracked, if corporate policy requires it.
2) They want the corporate traffic going through the VPN and they could care
less about the Internet traffic.  That traffic would then be routed in the
clear through the user's ISP.  Take the case of a retailer's store that
needs to use a VPN back to corporate for sales tracking and then access to a
bank's credit card authorization system that lives on the Internet.  That
traffic would be protected by whatever mechanism the bank requires.
Both cases can be accommodated by appropriate policies in the IPsec SPD.  

So the answer to your question is that if the VPN is implemented as
described in #2, then there is the possibility for the hacker to gain access
to the corporate network if the VPN is sitting there open and active.

My former employer at one point required employees to log into the corporate
network via the web before access to web based information was allowed.
There are other possibilities as well.  

Depending on the VPN client on the PC, it is possible to tear down the VPN
session after a timeout or each use and require a password, digital
certificate, or other security mechanism to re-establish it.  < The previous
comment is a supposition as I haven't fully investigated all of those
abilities.  It really depends on what you are using for a VPN client.  Your
company's security policies also play a role here as some of the VPN clients
can enforce global security policies are pre-defined by the corporate
network security managers.>

David

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
David Fox                                                
Quarry Technologies                                [email-masked]
8 New England Executive Park                 Office: 781-505-8300 x335
Burlington, Massachusetts  01803            FAX:   781-505-8316
www.quarrytech.com
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

 -----Original Message-----
From: 	Eliot Robinson [mailto:[email-masked]] 
Sent:	Friday, November 10, 2000 8:02 AM
To:	[email-masked]
Subject:	Windows2000 IPSec/L2TP VPN Security Threats

 << File: Eliot S. Robinson (E-mail).vcf >> I have heard that once a hacker
has access to your PC, the hacker from the
internet can ride your VPN tunnel to your secure network.  I thought that
once you connected to your IPSec/L2TP session, internet access was blocked.

Assume a dial up connection to the internet and then a Windows2000
IPSec/L2TP VPN connection to a secure network, what are the security
threats?

Second assumption, assume a DSL or cable modem connection to the internet
and a Windows2000 IPSec/L2TP VPN connection to a secure network, what are
the security threats?

If there are security threats, are these being taken into account in the
development/enhancement of the standards for L2TP and IPSec?

Does anyone know of any good reading material on this subject?

Thanks,

Eliot

Eliot S. Robinson
Sterling National Bank
430 Park Avenue, 4th Floor
New York, NY 10022-3505