{"id":1748,"date":"2011-10-12T11:45:55","date_gmt":"2011-10-12T19:45:55","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=1748"},"modified":"2012-03-08T17:01:07","modified_gmt":"2012-03-09T01:01:07","slug":"another-chrome-feature-a-new-hole-in-your-firewall","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2011\/10\/another-chrome-feature-a-new-hole-in-your-firewall\/","title":{"rendered":"Another Chrome Feature; A New Hole in Your Firewall?"},"content":{"rendered":"

The recent addition of remote desktop control to Google Chrome sounds pretty cool<\/a> \u2013 the casual, tech savvy user can now help their friend or family out if they are having problems with their PC. While remote access control features are indeed beneficial, in the hands of an unaware user, they have proven to be significant network security issues.<\/p>\n

In the 2011 Verizon Databreach Report <\/a>that analyzed 900 incidents worldwide, 320 of the initial penetrations could be tracked back to remote access errors.<\/p>\n

\"\"<\/span><\/div><\/a>The report implies that the common use (or misuse) of these tools is such that attackers have built it into their development efforts. From the report: \u201cAs soon as an intruder discovers a particular [remote access] vendor\u2019s authentication method and schema (be it for TCP port 3389 for RDP; or TCP port 5631 and UDP port 5632 for pcAnywhere), he will be able to exploit it across a multitude of that vendor\u2019s partners and customers. Oftentimes, in lieu of conducting a full port scan for these remote service applications, attackers will customize their scripts to exclusively look for these ports and search a broad swath of the Internet.\u201d<\/em><\/p>\n

Using our own research from the past two years of data collected and analyzed in the Application Usage and Risk Reports<\/a>, the 5 most frequently used remote access tools have remained consistent. The frequency of use is based on finding the application at least once within an organizations network. In all cases, more than one remote access control tool was found.<\/p>\n

\"\"<\/span><\/div><\/a><\/p>\n

The interesting trend seen is the growth in popularity of Teamviewer, an open source tool that, according to Wikipedia, supports nearly every client known to exist. So using Teamviewer, a support representative could conceivably help a customer using their Android-based phone. A very powerful business proposition. And therein lies the downfall. Since remote access control tool like Teamviewer may look like it is use by support or IT, there is a strong possibility that the use of these tools will punch an unnecessary hole (on a non-standard port) in the firewall (table 1).\u00a0
\n<\/span><\/span><\/p>\n

\"\"<\/span><\/div><\/a>
\n<\/a><\/p>\n

Google Chrome is no different in terms of its ability to punch through the firewall \u2013 it allows a user to configure the port it should use. From the above
\n<\/a>article: \"<\/em><\/span>If you have trouble connecting to the remote computer or it hangs when saying verifying access code, try allowing ports 443 and 5222 to have inbound and outbound rules in your windows firewall using both UDP and TCP.\"<\/em><\/p>\n

Again, a very powerful feature that, in the hands of an unsuspecting user, can present the organization with significant network security challenges. <\/span><\/p>\n

\u00a0Recommendations to avoid becoming a security breach statistic:<\/span><\/p>\n

    \n
  1. Learn which remote access tools are in use, who is using them and why. <\/span><\/li>\n
  2. Establish a standard list of remote access tools for those who need them<\/span><\/li>\n
  3. Establish a list of who should be allowed to use these tools. <\/span><\/li>\n
  4. Document the usage guidelines, complete with ramifications of misuse and educate ALL users.<\/span><\/li>\n
  5. Enforce the usage using traffic monitoring tools or better yet, a Palo Alto Networks next-generation firewall. <\/span><\/li>\n<\/ol>\n

    Users are smarter, more used to being online and expect to be able to use whatever application they desire. This is an understandable position, given the always online nature, but while at work, a balance must be achieved that protects the network, but enables the user.<\/span><\/p>\n

    The interesting trend seen is the growth in popularity of Teamviewer, an open source tool that, according to Wikipedia, supports nearly every client known to exist. So using Teamviewer, a support representative could conceivably help a customer using their Android-based phone. A very powerful business proposition. And therein lies the downfall. Since remote access control tool like Teamviewer may look like it is use by support or IT, there is a strong possibility that the use of these tools will punch an unnecessary hole (on a non-standard port) in the firewall (table 1).\u00a0
    \n<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    The recent addition of remote desktop control to Google Chrome sounds pretty cool \u2013 the casual, tech savvy user can now help their friend or family out if they are having problems …<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[31,11,1815],"coauthors":[],"class_list":["post-1748","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-application-control","tag-circumvent-security","tag-firewall"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/1748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=1748"}],"version-history":[{"count":15,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/1748\/revisions"}],"predecessor-version":[{"id":2204,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/1748\/revisions\/2204"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=1748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=1748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=1748"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=1748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}