Subject: Windows2000 IPSec/L2TP VPN Security Threats

From: "Eliot Robinson" <[email-masked]>
Date: Fri, 10 Nov 2000 08:02:00 -0500

I have heard that once a hacker has access to your PC, the hacker from the
internet can ride your VPN tunnel to your secure network.  I thought that
once you connected to your IPSec/L2TP session, internet access was blocked.

Assume a dial up connection to the internet and then a Windows2000
IPSec/L2TP VPN connection to a secure network, what are the security
threats?

Second assumption, assume a DSL or cable modem connection to the internet
and a Windows2000 IPSec/L2TP VPN connection to a secure network, what are
the security threats?

If there are security threats, are these being taken into account in the
development/enhancement of the standards for L2TP and IPSec?

Does anyone know of any good reading material on this subject?

Thanks,

Eliot

Eliot S. Robinson
Sterling National Bank
430 Park Avenue, 4th Floor
New York, NY 10022-3505

---

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 14 Nov 2000 00:49:25 -0800

Let us assume that "having access to your PC" means having access to
the administrator password. This by itself would not give the attacker
the credentials required to bring up L2TP/IPSEC tunnels (unless
the save password option were selected, a very bad idea). Moreover,
once an L2TP/IPSEC tunnel is set up, a default route is plumbed
pointing down the tunnel. This means that unless there is a
route to the attacker, either from the attacked system or
via the attacked corpnet, then once the tunnel comes up packets
will no longer be routed correclty from the attacked system back to the
attacker.

There are several actions you can take to protect against this
attack. The first measure is to use packet filtering or IPSEC to
protect BackOrifice, Terminal Services, Netmeeting Remote Control
and Telnet ports on machines that will be bringing up tunnels to
the corporate network. That way attackers will not be able to gain access
via these ports easily. I also recommend turning forwarding off.

Additional measures include use of smartcards or crypto tokens for user
login
and/or VPN access (this will only prevent an attacker from physically
logging into the machine or bringing up a tunnel; it will not prevent
an attacker who has gained access from using existing tunnels). A
major cause of compromises are poorly chosen passwords, so that the
strong password option should be selected to improve password security.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf
Of Eliot Robinson
Sent: Friday, November 10, 2000 5:02 AM
To: [email-masked]
Subject: Windows2000 IPSec/L2TP VPN Security Threats

Thanks,

Eliot

Eliot S. Robinson
Sterling National Bank