.

Auctioned VPN Server Becomes Security Nightmare

<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Wed Oct 01, 2008 1:48 pm

Auctioned VPN Server Becomes Security Nightmare

Still can't believe this kind of thing happens. Oh well, guess it keeps us employed.


A VPN server that was bought for less than a dollar on eBay proved to be a security nightmare as the new user found that it automatically connected itself to private networks.

Andrew Mason from Random Storm, a UK-based vulnerability management firm, picked up the Cisco Virtual Private Network from eBay in August. The device, he found when he plugged it in, connected itself to an English metropolitan borough's servers when plugged in.

A spokesperson for the borough, Kirklees, said it was a reason for concern, but remained confident that “multiple layers of security” prevented access to data. The spokesperson said, “In the meantime the disposal process has been suspended until an investigation can be carried out and appropriate action taken.”

Richard Farnworth, general manager, Enterprise Solutions, NEC (UK), said: “Protecting networking equipment and network topology is just as important in preventing security breaches as the recent spate of laptop, CD and memory stick losses we have seen. This latest announcement should not only act as a wake-up call to others, but demonstrated the growth in utility and appliance-style computing where the data and the intelligence is as much inherently ‘in' the network as those devices that connect to the network."

He added: “As so much dependence is placed upon connectivity in the ‘networked society' we belong to, it is imperative that both public sector organizations and commercial businesses take special care when disposing of any IT products. It will not come as a surprise that many ‘black box' devices hold configuration information within them and even consumers have cottoned on to the importance of securing their wireless networks at home, wiping hard disk drives before disposing of PCs and clearing memory banks in mobile telephones before sending them off for recycling.”



Original story:
http://www.scmagazineus.com/Auctioned-s ... le/118499/

Don
CISSP, MCSE, CSTA, Security+ SME
<<

dalepearson

Sr. Member
Sr. Member

Posts: 357

Joined: Thu Nov 09, 2006 10:03 am

Post Wed Oct 01, 2008 2:06 pm

Re: Auctioned VPN Server Becomes Security Nightmare

don wrote:Still can't believe this kind of thing happens. Oh well, guess it keeps us employed.


Don I agree, however this only continues to show that organisations are not taking enough to notice of the advice, guidance and policy statements to stop this simple mishaps occuring.
<<

geekyone

User avatar

Full Member
Full Member

Posts: 180

Joined: Fri Oct 26, 2007 12:45 pm

Location: Peoria, IL

Post Wed Oct 01, 2008 4:08 pm

Re: Auctioned VPN Server Becomes Security Nightmare

I can't believe he got a VPN server for less then a dollar.  :D
CISSP, CEH, GPEN, GCIH, GCFA
<<

$w33p3R

Newbie
Newbie

Posts: 30

Joined: Fri Aug 08, 2008 10:39 pm

Post Wed Oct 01, 2008 9:42 pm

Re: Auctioned VPN Server Becomes Security Nightmare

Nice article Don.  I think if I got a VPN server for less than a dollar, I would either think it is broke or the seller is up to something.  Don't know that I would hook it up to my production network without a bit of testing first.
MCP, CEH

Return to Hardware

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software