Researchers warn that hackers target Check Point remote access VPNs in an attempt to breach corporate networks. Using password-only authentication on old local accounts enables attackers to gain initial access to the company’s network.
Check Point released a security update on May 27th advising users to bolster VPN security. One day later, the vendor released a fix for this security issue, dubbed CVE-2024-24919.
According to its description on MITRE’s site, the flaw is
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades.
Source – MITRE
Remote access is available on all Check Point network firewalls. IT teams can use it as a client-to-site VPN for access to corporate networks via VPN clients or set up as an SSL VPN Portal for web-based access.
If you’re using a Check Point VPN solution, the first step to secure your network against this type of attack is to apply their recent patch.
Safety measures against remote access VPN attacks
CISA already advised security professionals worldwide to use multi-factor authentication to protect sensitive data and infrastructure. IT assets that rely on password-only protection are vulnerable to brute force attacks and password spraying.
Privileged accounts, jump servers, VPNs, etc. should all be protected by an MFA solution. They work as gateways into the internal network, so in case hackers succeed compromising them, they’ll get free passage inside your system.
[embedded content]
Keeping an up-to-date inventory of privileged accounts, like local admin accounts, is also high on the list of network security best practices.
Closely monitor privileges. Disable unused local accounts, revoke unnecessary privileges and enforce the principle of least privilege.
To make things more efficient and bolster security, use a Privileged Access Management tool that automates processes.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.
System admins waste 30% of their time manually managing user
rights or installations
Heimdal® Privileged Access
Management
Is the automatic PAM solution that makes everything
easier.
- Automate the elevation of admin rights on request;
- Approve or reject escalations with one click;
- Provide a full audit trail into user behavior;
- Automatically de-escalate on infection;
