Pulse Secure Services Are Not So-Secure--13 Flaws Found

Those using Pulse Secure services for their mobile office are learning their VPN (virtual private network) isn’t very secure after all. An alert was issued by CISA (Cybersecurity and Infrastructure Security Agency) warning thirteen malware samples were discovered in compromised Pulse Connect Secure devices. Their suite of VPN services covers the flow of data between remote mobile users and a company’s internal systems and is to provide fortified data security for all using it. That is, until the CISA alert was announced. Unfortunately, these flaws are not new, but should be addressed.

Pulse Connect Secure provides secured access to apps and resources in a data center and a cloud for those using mobile devices for remote work. Their VPN services are designed to provide security for data traveling from remote locations worldwide to a company’s internal data systems. Sounds great until we learned the thirteen malware samples found by CISA can avoid detection by antivirus products.

Attackers can leverage several vulnerabilities for Pulse Connect Secure devices, including placing webshells on the mobile devices. Webshells allow bypass functions including authentication, multi-factor authentication and password logging. With webshells in place, bad actors can remotely access a device, the VPN and all its data.

CISA has released guidelines and recommendations for IT and system administrators until security patches for the vulnerabilities are released. Note that some fixes have been released and those should be applied ASAP. Below are some of their other suggestions.

• Keep operating system patches up-to-date.
• Maintain up-to-date antivirus signatures and engines.
• Enforce a strong password policy and implement regular password changes.
• Disable unnecessary services on agency workstations and servers.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.

The CSV numbers include: CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-2289. There are various other recommendations listed by the developer to help avoid becoming the victim of attacks related to these and the others.