Hi

Simple question: Can a client infected with a trojan pass it on to a server
via a VPN connection?

Charlie

"Charlie42" <(E-Mail Removed)> skrev i meddelelsen
news:4A55989D-D898-4718-99A3-(E-Mail Removed)...
> Hi
>
> Simple question: Can a client infected with a trojan pass it on to a
> server
> via a VPN connection?
>
> Charlie

Yes.

"Mads Petersen" wrote:

> > Simple question: Can a client infected with a trojan pass it on to a
> > server
> > via a VPN connection?
>
> Yes.

Ok, simple questions calls for simple answers, I guess. :-) Would you care
to elaborate?

The server in question has Symantec Endpoint Security and is fully patched,
hence the network admin says it can not happen. But I am not convinced.

Charlie

www.google.com

"Charlie42" <(E-Mail Removed)> wrote in message
news:E8FC39AB-78C9-4263-8E4F-(E-Mail Removed)...
: "Mads Petersen" wrote:
:
: > > Simple question: Can a client infected with a trojan pass it on to a
: > > server
: > > via a VPN connection?
: >
: > Yes.
:
: Ok, simple questions calls for simple answers, I guess. :-) Would you
care
: to elaborate?
:
: The server in question has Symantec Endpoint Security and is fully
patched,
: hence the network admin says it can not happen. But I am not convinced.
:
: Charlie
:
:

Yes, of course. By itself a VPN offers zero protection against malware.
---
Leonard Grey
Errare humanum est

Charlie42 wrote:
> Hi
>
> Simple question: Can a client infected with a trojan pass it on to a server
> via a VPN connection?
>
> Charlie

Charlie42 wrote:
> "Mads Petersen" wrote:
>
>>> Simple question: Can a client infected with a trojan pass it on to a
>>> server
>>> via a VPN connection?
>> Yes.
>
> Ok, simple questions calls for simple answers, I guess. :-) Would you care
> to elaborate?
>
> The server in question has Symantec Endpoint Security and is fully patched,
> hence the network admin says it can not happen. But I am not convinced.
>
> Charlie

If malware can successfully avoid SEP's heuristics and IDS, and if
matching malware fingerprint(s) haven't made it to the local database
on a timely basis, then the odds are improved /for/ infestation. VPN
(or not), the malware /could/ then be faithfully passed - intact.

If you quoted your network admin verbatim, your admin could have more
carefully couched his remark. No protection system is perfect. A
recent review of Symantec's Endpoint Protection let a /bit/ of malware
get passed. However, overall, SEP is a good product.

<http://www.virusbtn.com/vb100/archive/2009/08>

What are the odds of your SEP protected system being infected from
your servers? Probably fairly low indeed.

--
1PW

From: "Charlie42" <(E-Mail Removed)>

| "Mads Petersen" wrote:

>> > Simple question: Can a client infected with a trojan pass it on to a
>> > server
>> > via a VPN connection?

>> Yes.

| Ok, simple questions calls for simple answers, I guess. :-) Would you care
| to elaborate?

| The server in question has Symantec Endpoint Security and is fully patched,
| hence the network admin says it can not happen. But I am not convinced.

| Charlie


a VPN connection means there is a virtual network tunnel that exists between you and the
network you connect to. While a trojan is not a virus which can self replicate, a trojan
still can be passed from the VPN client to the hosting networking. A VPN is a doorway and
once oped you or anything can step through that doorway. How that happens is another
matter.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Charlie42 wrote:
> Simple question: Can a client infected with a trojan pass it on to
> a server via a VPN connection?

It looks like you fat-fingered the question and added more later. However -
if there is a network connection/path between two machines - there is a
possibility of passing various types of infections between them.

The VPN connection may be a nice and safe tunnel for your data to run
through against outside intrusion - but you are inside the tunnel -
transferring whatever you want.

Now - the server may have some protection - but if anyone ever says that
anything is unbreakable/cannot be infested/infected - they are wrong or just
overstating the low percentage chance.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

> a VPN connection means there is a virtual network tunnel that
> exists between you and the network you connect to. While a
> trojan is not a virus which can self replicate, a trojan
> still can be passed from the VPN client to the hosting networking.
> A VPN is a doorway and once oped you or anything can step
> through that doorway. How that happens is another matter.

Thanks, David and Shenan.

The malware in question was a variant on the rogue Winweb Security program.
I have reinstalled Windows on the client now (a bit over the top, perhaps),
and made sure it is fully updated and protected. As for the server, well, I
figure that is the admin's problem. He's been notified.

Charlie

From: "Charlie42" <(E-Mail Removed)>

| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

>> a VPN connection means there is a virtual network tunnel that
>> exists between you and the network you connect to. While a
>> trojan is not a virus which can self replicate, a trojan
>> still can be passed from the VPN client to the hosting networking.
>> A VPN is a doorway and once oped you or anything can step
>> through that doorway. How that happens is another matter.

| Thanks, David and Shenan.

| The malware in question was a variant on the rogue Winweb Security program.
| I have reinstalled Windows on the client now (a bit over the top, perhaps),
| and made sure it is fully updated and protected. As for the server, well, I
| figure that is the admin's problem. He's been notified.

| Charlie


Right. Make sure the VPN client is fully protected.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp