Saint ConnectAround, Who Enters Through the VPN

Patron of corporate VPNs, security teams called back in January and CISA emergency directives.

Life

On 10 January 2024 Volexity reported two zero-days in Ivanti Connect Secure: one to skip authentication, the other to run commands. Together they opened from the outside the very door meant to let only employees in. Exploitation spread so widely that CISA ordered federal agencies to disconnect the appliances.

Prayer

O Saint ConnectAround, who goes around the login instead of through it, protect our VPN concentrators and the weekends of those who run them. Amen.

How to celebrate

Celebrated by applying the mitigations, running the integrity checker and, for the most devout, a factory reset.

The safest door is the one you never put on the internet.