Norway Recommends Replacing SSL VPN to Prevent Breaches

 A nice cybersecurity step from Norwegian National Cyber Security Centre (NCSC).

The Norwegian National Cyber Security Centre (NCSC) recommends replacing SSLVPN/WebVPN solutions with alternatives due to the repeated exploitation of related vulnerabilities in edge network devices to breach corporate networks.

NCSC's official recommendation for users of Secure Socket Layer Virtual Private Network (SSL VPN/WebVPN) products is to switch to Internet Protocol Security (IPsec) with Internet Key Exchange (IKEv2).

IKEv1 has some vulnerabilities for some product families i.e. "IKEv1 Information Disclosure Vulnerability in Multiple Cisco Products (CVE-2016-6415)" (CVSS 3.0 score is 7.5)

https://bit.ly/4dGmfVI

"The Norwegian National Cyber Security Centre (NCSC) recommends replacing SSLVPN/WebVPN solutions with alternatives due to the repeated exploitation of related vulnerabilities in edge network devices to breach corporate networks."

"While the cybersecurity organization admits IPsec with IKEv2 isn't free of flaws, it believes switching to it would significantly reduce the attack surface for secure remote access incidents due to having reduced tolerance for configuration errors compared to SSLVPN."

"Unlike IPsec, which is an open standard that most companies follow, SSLVPN does not have a standard, causing network device manufacturers to create their own implementation of the protocol."

"As an example, Fortinet revealed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws to breach organizations, including a Dutch military network."

"In 2023, the Akira and LockBit ransomware operations exploited an SSL VPN zero-day in Cisco ASA routers to breach corporate networks, steal data, and encrypt devices.

Earlier that year a Fortigate SSL VPN vulnerability was exploited as a zero-day against government, manufacturing, and critical infrastructure."

French Hospital Hit By Ransomware

And this time a hospital, the country is France.

A French hospital is hit by a $10 million RANSOMWARE attack. They could not give health services and had to send their patients to other establishments. The surgeries are postponed.

Yes, cybersecurity can have a direct effect on your life. You want to know how? Then continue reading.

https://www.bleepingcomputer.com/news/security/french-hospital-hit-by-10m-ransomware-attack-sends-patients-elsewhere/

"The Center Hospitalier Sud Francilien (CHSF), a 1000-bed hospital located 28km from the center of Paris, suffered a cyberattack on Sunday, which has resulted in the medical center referring patients to other establishments and postponing appointments for surgeries."

"'This attack on the computer network makes the hospital's business software, the storage systems (in particular medical imaging), and the information system relating to patient admissions inaccessible for the time being,' explains CHSF's announcement."

"Those in need of emergency care will be evaluated by CHSF's doctors, and if their condition requires medical imaging for treatment, they will be transferred to another medical center."

"According to Le Monde, which has info from the country's law enforcement agencies, the ransomware actors that hit CHSF demanded the payment of a ransom of $10,000,000 in exchange for a decryption key."

"French cybersecurity journalist Valéry Riess-Marchive identified signs of a LockBit 3.0 infection, mentioning that the handling by the national gendarmerie is a clue pointing to that direction, as that service deals with Rangar Locker and LockBit attacks."

"If LockBit 3.0 is responsible for the attack on CHSF, it will violate the RaaS program's rules, which prohibit affiliates from encrypting systems of healthcare providers."

RaaS: Ransomware as a Service