PC Review


Reply
Thread Tools Rating: Thread Rating: 3 votes, 5.00 average.

Infection via VPN?

 
 
Charlie42
Guest
Posts: n/a
 
      21st Aug 2009
Hi

Simple question: Can a client infected with a trojan pass it on to a server
via a VPN connection?

Charlie
 
Reply With Quote
 
 
 
 
Mads Petersen
Guest
Posts: n/a
 
      21st Aug 2009
"Charlie42" <(E-Mail Removed)> skrev i meddelelsen
news:(E-Mail Removed)...
> Hi
>
> Simple question: Can a client infected with a trojan pass it on to a
> server
> via a VPN connection?
>
> Charlie


Yes.


 
Reply With Quote
 
 
 
 
Charlie42
Guest
Posts: n/a
 
      21st Aug 2009
"Mads Petersen" wrote:

> > Simple question: Can a client infected with a trojan pass it on to a
> > server
> > via a VPN connection?

>
> Yes.


Ok, simple questions calls for simple answers, I guess. :-) Would you care
to elaborate?

The server in question has Symantec Endpoint Security and is fully patched,
hence the network admin says it can not happen. But I am not convinced.

Charlie


 
Reply With Quote
 
Tom Willett
Guest
Posts: n/a
 
      21st Aug 2009
www.google.com

"Charlie42" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
: "Mads Petersen" wrote:
:
: > > Simple question: Can a client infected with a trojan pass it on to a
: > > server
: > > via a VPN connection?
: >
: > Yes.
:
: Ok, simple questions calls for simple answers, I guess. :-) Would you
care
: to elaborate?
:
: The server in question has Symantec Endpoint Security and is fully
patched,
: hence the network admin says it can not happen. But I am not convinced.
:
: Charlie
:
:


 
Reply With Quote
 
Leonard Grey
Guest
Posts: n/a
 
      21st Aug 2009
Yes, of course. By itself a VPN offers zero protection against malware.
---
Leonard Grey
Errare humanum est

Charlie42 wrote:
> Hi
>
> Simple question: Can a client infected with a trojan pass it on to a server
> via a VPN connection?
>
> Charlie

 
Reply With Quote
 
1PW
Guest
Posts: n/a
 
      21st Aug 2009
Charlie42 wrote:
> "Mads Petersen" wrote:
>
>>> Simple question: Can a client infected with a trojan pass it on to a
>>> server
>>> via a VPN connection?

>> Yes.

>
> Ok, simple questions calls for simple answers, I guess. :-) Would you care
> to elaborate?
>
> The server in question has Symantec Endpoint Security and is fully patched,
> hence the network admin says it can not happen. But I am not convinced.
>
> Charlie


If malware can successfully avoid SEP's heuristics and IDS, and if
matching malware fingerprint(s) haven't made it to the local database
on a timely basis, then the odds are improved /for/ infestation. VPN
(or not), the malware /could/ then be faithfully passed - intact.

If you quoted your network admin verbatim, your admin could have more
carefully couched his remark. No protection system is perfect. A
recent review of Symantec's Endpoint Protection let a /bit/ of malware
get passed. However, overall, SEP is a good product.

<http://www.virusbtn.com/vb100/archive/2009/08>

What are the odds of your SEP protected system being infected from
your servers? Probably fairly low indeed.

--
1PW
 
Reply With Quote
 
David H. Lipman
Guest
Posts: n/a
 
      21st Aug 2009

From: "Charlie42" <(E-Mail Removed)>

| "Mads Petersen" wrote:

>> > Simple question: Can a client infected with a trojan pass it on to a
>> > server
>> > via a VPN connection?


>> Yes.


| Ok, simple questions calls for simple answers, I guess. :-) Would you care
| to elaborate?

| The server in question has Symantec Endpoint Security and is fully patched,
| hence the network admin says it can not happen. But I am not convinced.

| Charlie


a VPN connection means there is a virtual network tunnel that exists between you and the
network you connect to. While a trojan is not a virus which can self replicate, a trojan
still can be passed from the VPN client to the hosting networking. A VPN is a doorway and
once oped you or anything can step through that doorway. How that happens is another
matter.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


 
Reply With Quote
 
Shenan Stanley
Guest
Posts: n/a
 
      22nd Aug 2009
Charlie42 wrote:
> Simple question: Can a client infected with a trojan pass it on to
> a server via a VPN connection?


It looks like you fat-fingered the question and added more later. However -
if there is a network connection/path between two machines - there is a
possibility of passing various types of infections between them.

The VPN connection may be a nice and safe tunnel for your data to run
through against outside intrusion - but you are inside the tunnel -
transferring whatever you want.

Now - the server may have some protection - but if anyone ever says that
anything is unbreakable/cannot be infested/infected - they are wrong or just
overstating the low percentage chance.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


 
Reply With Quote
 
Charlie42
Guest
Posts: n/a
 
      22nd Aug 2009
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

> a VPN connection means there is a virtual network tunnel that
> exists between you and the network you connect to. While a
> trojan is not a virus which can self replicate, a trojan
> still can be passed from the VPN client to the hosting networking.
> A VPN is a doorway and once oped you or anything can step
> through that doorway. How that happens is another matter.


Thanks, David and Shenan.

The malware in question was a variant on the rogue Winweb Security program.
I have reinstalled Windows on the client now (a bit over the top, perhaps),
and made sure it is fully updated and protected. As for the server, well, I
figure that is the admin's problem. He's been notified.

Charlie

 
Reply With Quote
 
David H. Lipman
Guest
Posts: n/a
 
      22nd Aug 2009
From: "Charlie42" <(E-Mail Removed)>

| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote:

>> a VPN connection means there is a virtual network tunnel that
>> exists between you and the network you connect to. While a
>> trojan is not a virus which can self replicate, a trojan
>> still can be passed from the VPN client to the hosting networking.
>> A VPN is a doorway and once oped you or anything can step
>> through that doorway. How that happens is another matter.


| Thanks, David and Shenan.

| The malware in question was a variant on the rogue Winweb Security program.
| I have reinstalled Windows on the client now (a bit over the top, perhaps),
| and made sure it is fully updated and protected. As for the server, well, I
| figure that is the admin's problem. He's been notified.

| Charlie


Right. Make sure the VPN client is fully protected.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Are WinFixer 2005 popups a sign of infection or just attempts at infection? Donna Fox Windows XP Security 9 15th Jan 2006 06:47 PM
infection via .avi or .mpg files =?Utf-8?B?ZnVudG9vc2g=?= Windows XP General 1 22nd Dec 2004 01:44 AM
infection via .avi file =?Utf-8?B?ZnVudG9vc2g=?= Windows XP New Users 4 16th Dec 2004 12:59 AM
Editing Registry after Viral Infection =?Utf-8?B?R3JhbnQ=?= Windows XP Help 2 22nd Dec 2003 07:29 PM
Internet Explorer Infection Bill Mulvihill Windows XP Help 2 4th Dec 2003 01:38 PM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 06:27 PM.