QUESTION POSED ON: 14 February 2003
I just read your entry where you can't emphasis enough the dangers of
split tunneling. Since I asked my last question on this issue, I've done a
little bit more reading.
Basically, if a device ever connects to the Internet in an uncontrolled
fashion, it can be compromised and that compromise can be exploited when
that machine starts up its VPN connection. The results of the exploit
sent back the hacker when the VPN shuts down. In fact, it can probably be sent
out through the corporate proxy firewall. Therefore, all VPNs are a bad idea, not just the ones with split tunneling.
Further, the VPN vendor software can have complete control over the
network interfaces on the remote machine (e.g. it can shut them down to
disable split tunneling). Therefore, it should be able to prevent traffic
coming in from one interface being routed down the virtual interface of the
VPN. Along with the prevention of IP address spoofing for the local IP
addresses, this can effectively disable the exploitation of an "active"
split-tunnelled connection. I don't know if any of the software available
attempts to do this, but all the information is available to it. This still
doesn't solve the fact that a compromised machine is a compromised machine
and once compromised, connecting it a corporate network is dangerous.
|
