SSL VPNs can be compromised in a way that enables them to take over remote users’ machines and potentially cause mischief inside the networks they attach to, according to research presented at the Black Hat conference.
The problem can exist with Web clients that install themselves on remote machines at the start of SSL VPN sessions, said Michael Zusman, a senior consultant for the Intrepidus Group.
Elements of the so-called Web clients Zusman referred to can expose them to attacks, however. These clients are downloaded to remote machines by SSL VPN gateways and include Active X components. Some vendors include a feature that enables the client to launch full application clients on the remote machine.
So, if remote users want to access a corporate accounting application, for example, they click on that application as listed on the VPN portal. The VPN client then launches the client for the accounting application so users don’t have to do it manually, making the process cleaner.
The danger lies in these clients’ reliance on an Active X component that acts as an application launcher, which means it also could launch malicious code, Zusman said. So, the convenience of having the SSL VPN client launch other client applications opens up a potential attack vector, he said. “I think that’s a pretty bad tradeoff,” he said.