Defeating VPN Always On
Maxime Clementz evaluates Windows VPN Always-On enterprise security controls, demonstrating design and implementation bypasses to reach untrusted networks.
Summary
The Purpose of VPN Always-On Enterprise Controls
Organizations enforce 'VPN Always-On' policies on mobile corporate laptops to ensure all network traffic is encrypted and routed exclusively through corporate security gateways.
Auditing Windows Network APIs and Commercial VPN Clients
Maxime Clementz examines how the Windows networking stack and popular commercial enterprise VPN solutions enforce persistent gateway routing rules.
Discovering Design and Implementation Bypasses
Analyzing DNS resolution flows, local subnet routing exceptions, and captive portal helper daemons reveals methods to bypass network tunneling and reach local networks directly.
Hardening Always-On VPN Deployments
Clementz provides actionable hardening configurations for enterprise network administrators to close routing leakage paths and secure endpoints on untrusted public Wi-Fi.
Related talks
Main Stage·46 min
Orange Tsai
Discovers critical pre-authentication remote code execution vulnerabilities in three leading enterprise SSL VPN products.
Main Stage·42 min
Omer Yair
Ironically weaponizes Windows Control Flow Guard (CFG) internals to construct more reliable ROP exploit chains by abusing CFG's bitmap.
Briefings·38 min
Alex Bourla · Graham Brereton
Palo Alto Networks' GlobalProtect is a widely adopted remote access solution used by major organisations worldwide — but how robust is it.