A Closer Look at the Android VPN Flaw

It’s been a rough couple of years for Android devices. Sure, there may have been more than 900 million of them activated in 2013 alone, but those impressive sales numbers do nothing to inhibit cyber criminals from exploiting these open source devices. We’ve discussed Android vulnerabilities at some length, and have demonstrated how a centrally managed VPN as part of a defense in depth secure remote access framework can mitigate many of these threats. However, the recent revelation from Ben Gurion University of malicious apps that can be used to bypass VPN configurations and push communications to a different network address changes the conversation entirely. As Jeffrey Ingalsbe, director of the Center for Cyber Security and Intelligence Studies at the University of Detroit Mercy, told SC Magazine, that’s because this new vulnerability “attacks one of the [security] pillars we thought we could count on in the mobile world,” – VPNs. Ingalsbe is right – VPNs have been a cornerstone to secure remote access to corporate networks for a long time now, and the possibility that the peace of mind they ensure has been compromised is alarming. However, if we take a closer look at the vulnerability uncovered by Ben Gurion University, it becomes apparent that cyber criminals are attempting to use an old trick in a new disguise. Man-in-the-middle (MitM) attacks, a form of which the researchers used to bypass VPN security, are actually pretty simple. They are designed to intercept communications between two endpoints (e.g. an Android device and a corporate network) before those communications have entered the safety of a VPN’s encrypted tunnel. Instead, the unencrypted data...

Do You Plan to Use the Per App VPN Feature in iOS 7?

Despite the rise of the bring-your-own-device (BYOD) movement in recent years, Apple’s popular iPhone and iPad haven’t really been geared toward making the lives of enterprise IT administrators any easier. However, with several new business-centric features now included in the upcoming iOS 7 release, that could all be about to change. Apple is billing the new iPhone 5S as the “most secure mobile phone ever.” Whether that proves true or not remains to be seen, but so far, the iOS 7 updates are a bit more interesting. Chief among them is the new per app VPN feature. According to Apple’s website, “Apps can now be configured to automatically connect to VPN when they are launched. Per app VPN gives IT granular control over corporate network access. It ensures that data transmitted by managed apps travels through VPN — and that other data, like an employee’s personal Web browsing activity, does not.” With reports that 76 percent of enterprises are now formally supporting BYOD, IT administrators are sure to welcome such granular control. Not only does such a feature have the potential to improve data security, but it could also make company-wide app rollouts significantly easier and lighten the traffic load on corporate networks. But, perhaps the most important thing to remember is that enterprises cannot afford to become complacent when it comes to remote access policies and best practices. As mobile device manufacturers and application developers work to make their products more enterprise-friendly, they are ultimately designing them for convenient use by consumers. IT teams must remain vigilant when it comes to managing these devices and how they connect...

The Need for Network Security in the Face of Android Vulnerabilities

We’ve given Android at lot of attention over the past year, and rightfully so. The operating system is, after all, the most widely used in the world. Yet, with each version and new feature that Google rolls out, the security of mobile devices with older Android releases falls farther down the priority ladder, and unfortunately for IT executives, this means their enterprises become more susceptible to potential attacks. Recognizing this, the Department of Homeland Security (DHS) and the FBI have issued a warning to police and fire departments, as well as emergency medical service providers that mobile devices with outdated Android versions pose a serious security risk to their organizations. ThreatPost reported that the warning came via an unclassified memo distributed to the aforementioned organizations back in July, though it was only recently made public. Citing unspecified industry statistics, the memo stated that 44 percent of Android users are currently running Gingerbread, which was originally released in 2011 and is now significantly less supported. Improvements have been implemented in more recent versions of the operating system, but Gingerbread has had quite a few security vulnerabilities, such as premium-rate SMS Trojans, rootkits and fake Google Play domains that attackers use to trick users into installing malicious applications. The obvious concern here is that employees that have not updated their personal mobile devices are exposing critical networks and sensitive information to unnecessary risk. The FBI and DHS have urged their employees to regularly update their smartphones and tablets and to only download applications from the official Google Play store. But will those precautions be enough? What happens when someone attempts to...

NCP engineering’s Remote Access VPN Management System Now Linux-Compatible

A recent Linux enterprise end-user survey found that more than 80 percent of respondents plan to increase the number of Linux servers in their organizations over the next five years. As such, it’s imperative that IT takes all the necessary precautions to ensure a company’s networking hardware and software supports Linux. Heeding this market demand, NCP engineering has announced the availability of its Linux-compatible Secure Enterprise Management System (SEM) 3.0. The NCP SEM 3.0 is a fully automated VPN management software solution that was recently named a finalist in the American Business Awards. By centrally controlling enterprise VPN clients and SSL/IPsec VPN gateways, NCP’s technology substantially reduces the complexity and total cost of ownership (TCO) for network administrators. SEM 3.0 also supports the NCP Secure Enterprise Android Client, which allows IT administrators to seamlessly and safely integrate employees’ Android 4.0+ smartphones or tablets into their enterprises’ remote access VPN infrastructure. NCP simplifies the process of configuring VPN clients on Android devices, and helps administrators easily issue certificates, licenses and other security updates. Enterprises utilizing SEM 3.0 for Linux can now enjoy the benefits of NCP’s advanced Two-Factor Authentication, too. This solution is enabled with a mobile phone or device that uses a One-Time Password that users receive via SMS. Each password provided by NCP is a created by a random number generated within the NCP Advanced Authentication Connector. To learn more about the NCP SEM 3.0’s new Linux compatibility, check out the full press release here. Happy SEM Linux users – we’d love to hear your feedback on the...

eWeek Explains How NCP’s VPN Client Supports Android BYOD Security

Enterprises know they’ll have happier employees if they embrace BYOD rather than prohibit it. Welcoming BYOD can be better for business output, too—the trick is to find the tools that keep employees productive when they’re using their own smartphones, tablets or laptops to access the corporate network remotely. In his recent reviews of NCP’s managed IPsec VPN clients compatible with Android (version 4.0 and higher), eWeek journalist Jeff Cogswell set out to determine just how well NCP’s VPN supports BYOD. The result? Not just a pass, but one with flying colors. Cogswell was particularly sold on a few of NCP’s product features that make it suited for welcoming Android-based mobile devices into the enterprise. For one, the installation was a quick and painless process. Right away, Cogswell connected to NCP’s test server and his own VPN server, which is OpenBSD. He also tested it with a Cisco server, and it worked in all cases—the fact that NCP’s Secure Enterprise Android Client is compatible with all common VPN gateways is a huge plus, since IT departments are increasingly compelled to support various platforms. The eWeek reviewer was also relieved that his smartphone didn’t have to be rooted; in fact, he said it’s a significant differentiator between NCP’s offering and other Android apps: “I have spent a lot of time using Android devices in recent years, and what struck me as particularly interesting is that your phone doesn’t need to be rooted. Rather, Android supports the networking tasks that this VPN client requires. That’s a huge plus.” Cogswell highlighted many other benefits, including how the client allows you to choose the...