Peter Fuggle wrote:
You are right that "split tunneling" does not guarantee that the
remote network offering the VPN connectivity is safe from a
compromised client. Generally the client will be allocated an address
on the remote LAN - that's usually the point of establishing the
tunnel is it not? Now sure, the vpn client software can ensure that
the client can only make connections through the tunnel and not to
other devices on the local LAN or out to the internet. But depending
I disagree entirely with this assertion. It's not possible to guarantee
that a piece of software even has the ability to prevent non-VPN
connections even under perfect conditions. It is after all nothing but
another piece of software. And remember that within context we're
talking about a possibly compromised machine which could have a
buggered up copy of VPN client software.
Again, you absolutely ca not completely "shut off the Internet" because
the Internet is your "carrier". That connection still exists, and no
matter how adept a piece of software might be at filtering out
extraneous noise it can never be perfect.
upon how controlled egress connections are on the remote LAN, the
compromised client can still pose a risk. For example, the client has
At this point it becomes a moot argument because influence over the
connection is out of the client's hands.
a shell bot installed that connects out to the attacker's machine and
there is no control on outbound connections from the remote LAN...
If an attacker has compromised the machine to the point that it can
make surreptitious connections at all, there's no VPN software on the
planet that's going to save you.
Compromised client establishes tunnel, shellbot connects out to
control machine _through tunnel_, attacker has full access to VPN
client and LAN that the client is connected into. In a case like
this, split tunneling gains nothing.
I'd say this is a waste of an attacker's time. ;) It's easier and far
more reliable to make a direct connection, avoiding the additional
problems and chances of being spotted that tunneling the unwanted
connection through yet another network/server/etc brings to the table.
--
Hand crafted on 27 November, 2006 at 00:19:53 EST using
only the finest domestic and imported ASCII.
I'd like to meet the guy who invented beer, and
see what he's working on now.
signature.asc
Description: PGP signature
