Tester claims 90% of VPNs open to hackers

[R.A. Hettinga]

<http://www.computerweekly.com/print/ArticlePrinterPage.asp?liArtID=136571&liFlavourID=1>


Printed from ComputerWeekly.com

IT Management: Security

by Antony Savvas
Tuesday 8 February 2005
Tester claims 90% of VPNs open to hackers
Security testing company NTA Monitor has claimed that 90% of virtual
private networks are open to hackers.

 Over a three-year period of testing VPNs at large companies, NTA Monitor
said 90% of remote access VPN systems have exploitable vulnerabilities,
even though many companies, including financial institutions, have in-house
security teams.

 Flaws include "user name enumeration vulnerabilities" that allow user
names to be guessed through a dictionary attack because they respond
differently to valid and invalid user names.

 Roy Hills, NTA Monitor technical director, said, "One of the basic
requirements of a user name/password authentication is that an incorrect
log-in attempt should not leak information as to whether the user name or
password is incorrect. However, many VPN implementations ignore this rule."

 The fact that VPN user names are often based on people's names or e-mail
addresses makes it relatively easy for an attacker to use a dictionary
attack to recover a number of valid user names in a short period of time,
said Hills.

 Passwords can also be made harder to crack by deploying a mixture of
characters and numbers. Hills said a six-character password can be cracked
in about 16 minutes using standard "brute force" cracking software.
However, a six-character password combining letters and numbers could take
two days to crack.


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com