NSA, CISA share guidelines for securing VPNs as hacking groups keep busy

"VPN servers are entry points into protected networks, making them attractive targets," said an NSA official.

Cautioning that foreign government-backed hackers are actively exploiting vulnerabilities in virtual private network devices, the National Security Agency and the Department of Homeland Security’s cyber wing on Tuesday published guidelines for securing VPNs.

While the advice is broad, the NSA and DHS’ Cybersecurity and Infrastructure Security Agency specifically said it would help protect the Defense Department, national security systems and defense contractors against such advanced persistent threat groups, a term that typically refers to state-sponsored hacking groups. The NSA has specifically warned in the past about Chinese hackers exploiting VPN vulnerabilities, as has CISA, but the history of advanced groups seizing on VPN vulnerabilities is far broader and lengthier.

“VPN servers are entry points into protected networks, making them attractive targets,” Rob Joyce, director of cybersecurity at the NSA, said on Twitter. “APT actors have and will exploit VPNs.”

In one case, the FBI warned in May about hackers leveraging VPN technology made by Fortinet to target a municipal government. VPN technology typically promises a secure connection to a protected server, meaning many subjects may be operating with an inflated sense of security.

NSA said there are many dangers that accompany not fortifying VPNs against attacks from groups that exploit publicly exposed information security flaws in the Common Vulnerabilities and Exposures (CVE) database.

“Exploitation of these CVEs can enable a malicious actor to steal credentials, remotely execute code, weaken encrypted traffic’s cryptography, hijack encrypted traffic sessions, and read sensitive data from the device,” an NSA news release explained. “If successful, these effects usually lead to further malicious access and could result in a large-scale compromise to the corporate network.”

The guidance continues as NSA and CISA focus on recommending defenses against threats to federal agency employees, especially since the COVID-19 pandemic accelerated vulnerabilities as federal agency personnel have shifted toward working from home. That work-from-home trend is set to continue.

It also reflects the latest NSA guidelines on protecting VPNs.

The latest recommendations include selecting VPNs from reputable vendors, patching known vulnerabilities and running features that are “only strictly necessary.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure