Check Point releases emergency patch after hackers attack VPN networks

Check Point has released an emergency patch for a zero-day vulnerability used to attack remote access VPN devices.

Remote access VPNs are integrated into all Check Point networks via VPN clients and were intended to attempt to compromise corporate networks.

On Monday, the company issued a warning about an increase in attacks on VPN devices, providing recommendations on how administrators can protect their devices. It later turned out that the problem was a zero-day vulnerability exploited by hackers.

The company said at the time that it had witnessed multiple trials that, when analyzed, showed the same pattern.

(For the top tech news of the day, sign up for our Today’s Cache tech newsletter)

“This vulnerability could allow an attacker to read certain information on Internet-connected gateways with remote VPN or mobile access enabled,” the company said in a blog post.

The company has created an FAQ page with additional information about the vulnerability and has created a remote access validation script that can be used to review the results and take appropriate action.

Check Point is the second company to issue an advisory warning customers about attacks on VPN devices. Previously, Cisco also warned of widespread credential-based brute-force attacks targeting VPN and SSH services on Cisco, Check Point, Sonic Wall, Fortinet, and Ubiquiti devices.

The campaign reportedly began around March 18 with attacks originating from TOR exit nodes, which are used to anonymize users’ network access to ensure private web browsing, thereby increasing network security. According to a report by Bleeping Computer, the attack campaign used various anonymization tools and proxies to avoid blocks.