Avast: a forgotten VPN profile without MFA
Avast was breached through a temporary VPN profile that was left enabled and didn’t require two-factor authentication.
Avast said yesterday that an attacker got into its internal network through a temporary VPN profile that had been left enabled by mistake and didn’t require two-factor authentication. The company believes the target was CCleaner, whose updates were hijacked by a different attack in 2017. As a precaution, it paused CCleaner updates and re-signed its software with a new certificate.
“Temporary” access that never gets removed is one of the most common findings in any audit.
- Give every temporary account an expiry date when you create it.
- Require MFA for all VPN profiles, with no exceptions for tests.
- Review VPN and remote access accounts monthly, and disable unused ones.
- Protect your code-signing keys and build servers separately from the rest of the network.