Why VPN Hacks Can Be Catastrophic

The Internet is fraught with various kinds of threats. There are viruses, which infect your computer, corrupt your files, and even damage the hardware in some cases. Then there are ransomware attacks, which are even more dangerous. When a hacker manages to infect your device with a ransomware, he takes your device hostage and demands a certain ransom to return you access to your computer. In most cases, even paying the ransom doesn’t bring back your device. The types of threats circulating on the Internet are myriad. They come in various names and shapes and can do varying degrees of harm to your computer and the data stored. To be safe from such attacks, people resort to several solutions, from anti-malware applications to virtual private networks. The latter is supposed to be a foolproof solution, keeping data safe from all kinds of intruders. But is it really as safe as we consider it to be?

VPN Hacks are Lethal

A cybersecurity expert has warned that VPNs must be used very carefully because they are as vulnerable as any other technology. Many organizations use VPNs for securing remote connections, but there are associated risks that can be lethal.

Although not as common as ransomware attacks, VPN hacks are often used as part of highly strategic cyber-attacks, warns Ofer Shezaf, director of cybersecurity at Varonis Systems. Because these attacks aren’t as well known or common, not much is known about the way they are caused.

But the security expert warns that they can be as dangerous as the 2015 power outage in Ukraine caused by a cyber-attack. To be able to shut down the circuit breakers at a substation, the hackers needed to access the system.

For accomplishing this, the attackers possibly stole the credentials and entered the system through the VPN in use, with the means of a hijacked account.

There are a few other examples of VPN hacks, which include a case from 2014 where a system administrator who was fired from a large US paper manufacturing company, took revenge by using VPN remote access and destroying manufacturing equipment.

Yet another example is the RSA breach, where the attackers stole the private key used to create RSA’s Secure IDs and attacked organizations that used Secure ID through their VPN, going on to steal confidential data from a major defense contractor.

VPN Advantages

Companies use VPNs to protect the whole computer system from data theft and privacy breaches. Using a VPN indeed provides a great degree of data protection, preventing even the Internet service provider from intruding and stealing information. However, if the VPN is hacked, the whole computer network of that organization is affected. 

Sensitive information can be easily stolen in this type of attack, and it can leave the company vulnerable. If the attack happens on any of the major utilities like power or transport, the entire country can be affected.

Even though such events have only yet happened in movies, the day may not be far when such cyber attacks rock the world.

How to Stay Safe

The most common practice today against such hacks is two-factor authentication. When two-factor authentication (2FA) is enabled, the user needs to enter a text message, one-time password, or a security question besides a password to authenticate access.

Biometric means like a fingerprint or face recognition are always used for two-factor authentication. But even though this approach mitigates some of the risks, it isn’t enough. One time passwords and text messages can easily be bypassed, especially if the hackers are sophisticated.

Many attackers also make sure of a flaw or a bug in the signaling protocol to get access to passwords or text messages. Several past incidents have proved that two-factor authentication works for smaller attacks, but advanced cybercriminals can always find ways around it.

Instead of resigning to the fact that VPN attacks will keep happening and there’s no way to prevent them, cybersecurity experts have been trying to use advanced technology like machine learning to detect attacks from beforehand. Advanced analytics are going to be combined with the VPN data to ensure more accurate detection of threats.

For instance, unexpected access from a remote location will arouse suspicion if the user didn’t log in, or an unusual amount of data transfer through a VPN connection will be alarming if the sensitive data was also accessed at the same time.

Although these solutions are still in the planning stage, experts are hopeful that advanced technology will make it easier to detect threats just as they make it easy for hackers to breach the system.