Several enterprise virtual private networking apps are vulnerable to a security bug that can allow an attacker to remotely break into a company\u2019s internal network, according to a warning issued by Homeland Security\u2019s cybersecurity division.<\/p>\n
An alert was published Friday<\/a> by the government\u2019s Cybersecurity and Infrastructure Security Agency following a public disclosure<\/a> by\u00a0CERT\/CC, the vulnerability disclosure center at Carnegie Mellon University.<\/p>\n The VPN apps built by four vendors \u2014 Cisco, Palo Alto Networks, Pulse Secure, and F5 Networks \u2014 improperly store authentication tokens and session cookies on a user\u2019s computer. These aren\u2019t your traditional consumer VPN apps used to protect your privacy, but enterprise VPN apps that are typically rolled out by a company\u2019s IT staff to allow remote workers to access resources on a company\u2019s network.<\/p>\n The apps generate tokens from a user\u2019s password and stored on their computer to keep the user logged in without having to reenter their password every time. But if stolen, these tokens can allow access to that user\u2019s account without needing their password.<\/p>\n But with access to a user\u2019s computer \u2014 such as through malware \u2014 an attacker could steal those tokens and use them to gain access to a company\u2019s network with the same level of access as the user. That includes company apps, systems and data.<\/p>\n So far, only Palo Alto Networks has confirmed its GlobalProtect app was vulnerable. The company issued a patch<\/a> for both its Windows and Mac clients.<\/p>\n Neither Cisco nor Pulse Secure have patched their apps. F5 Networks is said to have known about storing since at least 2013<\/a> but advised users to roll out two-factor authentication instead of releasing a patch.<\/p>\n CERT warned that hundreds of other apps could be affected \u2014 but more testing was required.<\/p>\n\n