Coordinated global attack against Checkpoint VPN?

[Juergen_Blumens]

Hello colleagues,

We have been experiencing a massive distributed attack against our Endpoint VPN access over the last few weeks. Login attempts are being made from various source IP addresses. Even known usernames are being used. caseyb describes this attack here https://community.checkpoint.com/t5/General-Topics/R81-20-Jumbo-Hotfix-Accumulator-take-96-has-been-..., which I also see here.

Unfortunately, the technical defense measures are limited, as the attacker tries different user accounts from one IP. We need a solution that blocks failed login attempts with different user accounts from the same IP.

Question to the community: Do you also see failed login attempts in your logs, for example from the IP 138.124.184.205?

Greetings
Juergen

[G_W_Albrecht]

What about using certificate authentication ? Username/PW is rather very old-fashioned...

[Juergen_Blumens]

No, we had that in the past. The administrative effort is too high. Security also depends on how passwords are composed.

[G_W_Albrecht]

I see.

[CaseyB]

We have not really explored certificate authentication for the Endpoint VPN, I would like to imagine administrative overhead issues with that as well, but I could be mistaken.

We do have MFA on the VPN, so I'm not as concerned.

[Wolfgang]

@Juergen_Blumens how about using SmartEvent ? You can define as an example an action to block the source IP for the next hour.

[the_rock]

If you know the IP does not change, I would use SAM rule to block it, its instant and you dont even need to install policy.

Andy

[Juergen_Blumens]

The problem is that it is a distributed attack from around 60 different IP addresses that are distributed worldwide. It's not easy to detect the attacker in the logs at first, then I have to configure the drop afterwards. Until then, the attacker comes from other IPs. That's why I want to request the new feature from sk182087 not only on a user-specific basis, but also to block the Source IP in the event of several unsuccessful login attempts within a short period of time.

At first I thought this was just an attack against us, but after CaseyB's screenshot I can see that the same attacker is trying it on other Checkpoint firewalls at the same time. Can you take a look on your logs, do you also see failed login attempts from the IP 138.124.184.205?

[the_rock]

I understand what you mean. Just checked, dont see anything for that IP for the last year.

Andy

[PhoneBoy]

Based on https://support.checkpoint.com/results/sk/sk182087 this behavior is by design.
Specifically: "The main motivation behind not to remember only a public IP address is to avoid collective DoS attacks that might block multiple Remote Access VPN users, who may connect from behind the same NAT device."

[Juergen_Blumens]

You're right about that. However, it should still be possible to select for incorrect login attempts within a narrowly defined period. Real users do not have so many failed attempts.