Riesgos de seguridad de PPTP VPN

PPTP is Microsoft’s VPN implementation, which has been around since Windows NT. Users tend to like using PPTP as it’s typically configured on Windows Desktops with a shortcut that remembers username and password for quick access.

With proper name resolution (historically WINS) and now DNS, users can easily browse the network for shares and printers. On the back end, the system administrator configures Windows Server PPTP with the Routing and Remote Access role (RRAS).

While the tools used to manage and deploy PPTP Systems have changed with each new version of Windows it’s universally agreed that PPTP is insecure as compared to modern alternatives and adds additional indirect support costs even when upgraded to support SSTP.

El protocolo PPTP en sí mismo ya no se considera seguro, ya que descifrar la autenticación MS-CHAPv2 inicial se puede reducir a la dificultad de descifrar una sola clave DES de 56 bits, que con las computadoras actuales se puede forzar por la fuerza bruta en muy poco tiempo (haciendo un contraseña segura en gran medida irrelevante para la seguridad de PPTP, ya que se puede buscar en todo el espacio de claves de 56 bits dentro de limitaciones de tiempo prácticas).

An attacker can capture the handshake (and any PPTP traffic after that), do an offline crack of the handshake, and derive the RC4 key. Once the RC4 key is derived, the attacker will be able to decrypt and analyze the traffic carried in the PPTP VPN. PTP does not support forward secrecy, so just cracking one PPTP session is sufficient to crack all prior PPTP sessions using the same credentials.

PPTP provides weak protection to the integrity of the data being tunneled. The RC4 cipher, while providing encryption, does not verify the integrity of the data as it is not an Authenticated Encryption with Associated Data (AEAD) cipher.

PPTP also doesn’t do additional integrity checks on its traffic and is vulnerable to bit-flipping attacks, e.g. the attacker can modify the PPTP packets with little possibility of detection. Various discovered attacks on the RC4 cipher (such as the Royal Holloway attack) make RC4 a bad choice for securing large amounts of transmitted data, and VPNs are a prime candidate for such attacks as they typically transmit sensitive and large amounts of data.

Puerto PPTP

El Protocolo de tunelización punto a punto (PPTP) utiliza el puerto TCP 1723 y el protocolo IP 47 Encapsulación de enrutamiento genérico (GRE). Es posible que los ISP bloqueen el puerto 1723 y es posible que muchos firewalls y enrutadores modernos no pasen el protocolo IP GRE 47.

PPTP VPN Vulnerabilities

Los expertos en seguridad han revisado PPTP y han enumerado numerosas vulnerabilidades conocidas, entre ellas:

MS-CHAP-V1 es fundamentalmente inseguro

Tools exist that can easily extract the NT Password hashes from MS-CHAP-V1 authentication traffic. MS-CHAP-V1 is the default setting on older Windows Servers.

MS-CHAP-V2 es vulnerable

MS-CHAP-V2 is vulnerable to dictionary attacks on captured challenge response packets. Tools exist to crack these exchanges rapidly.

PPTP VPN Brute Force Attack Possibilities

It has been demonstrated that the complexity of a brute-force attack on an MS-CHAP-v2 key is equivalent to a brute-force attack on a single DES key. With no built-in options for Multi-Factor/Two-factor authentication, this leaves PPTP implementations highly vulnerable.

PPTP VPN Additional Support Costs

Tenga cuidado con los costos de soporte adicional comúnmente asociados con PPTP y Microsoft VPN Client.

• De forma predeterminada, la red de Windows de un usuario final se enruta a través de la red VPN de la oficina. Como resultado, esto deja la red interna abierta a Malware y ralentiza Internet para todos los usuarios de la oficina.
• PPTP is typically blocked at many locations due to known security issues resulting in calls to the help desk to resolve connectivity issues.
• Conflicts with office internal subnets at remote sites can block Microsoft VPN routing resulting in no connectivity and again leading to additional support costs.
• Minor network fluctuations can disconnect the Microsoft VPN client while in use corrupting files and leading to restores and lost work.
• El Departamento de TI deberá mantener una flota adicional de computadoras portátiles corporativas con Microsoft VPN preconfigurado para cada posible usuario remoto.
• Crypto Locker type malware is free to encrypt files over the VPN tunnel.

PPTP VPN – MyWorkDrive as a Solution

MyWorkDrive actúa como el perfecto Alternativa VPN solución

A diferencia de MyWorkDrive, se eliminan los riesgos de seguridad de admitir Microsoft PPTP o SSTP VPN:

• Los usuarios obtienen un cliente Web File Manager elegante y fácil de usar al que se puede acceder desde cualquier navegador.
• IT Support costs are eliminated – users simply log on with their existing Windows Active Directory/Entra ID credentials or use ADFS or any SAML provider to access company shares, home drives, and edit/view documents online.
• Los clientes móviles para Android/iOS y MyWorkDrive Desktop Mapped Drive están disponibles.
• A diferencia de VPN, bloquee los tipos de archivos y reciba alertas cuando los cambios en los archivos excedan los umbrales establecidos para bloquear el ransomware.
• Por seguridad, todos los clientes de MyWorkDrive admiten la autenticación de dos factores DUO.