topic Re: Security flaw with GlobalProtect? in General Topics

Security flaw with GlobalProtect?

pasmartin — Wed, 22 Oct 2014 08:34:57 GMT

Hi,

While setting up a computer with fingerprint authentication+windows password, I discovered that after installing GlobalProtect I could circumvent the whole two-factor authentication by choosing to login with GlobalProtect(clicking the GP icon in the login screen of windows, instead of using the "security key"). The OS used was Windows 8.1 x64.

Don't know if you're aware of this flaw, or if this is something that can be disabled in PANOS - though I don't think there's many people out there wanting this as a functionality :smileysilly:

Re: Security flaw with GlobalProtect?

lewis — Wed, 22 Oct 2014 15:09:22 GMT

Can you clarify what you mean about "clicking the GP icon in the login screen of windows". Is this an icon when you boot your Windows device?

Re: Security flaw with GlobalProtect?

pasmartin — Thu, 23 Oct 2014 11:44:46 GMT

It's the "sign in options" that you'll find in (at least) windows *8* and windows 2012 server - it's located below the password input. So, I can either choose the "key", which is the windows password (in this case two-factor with fingerprint), or I can choose GP, which then circumvents the whole fingerprint process, and lets me login using only the domain password, instead of domain password + fingerprint.

This could be prevented by implementing two-factor authentication on GlobalProtect - but that's not how it should be :smileysilly:

Re: Security flaw with GlobalProtect?

lewis — Thu, 23 Oct 2014 11:52:53 GMT

ok, when i read your original post i thought you were just clicking the GP icon and it passed you in without a password. we have not tried 2 factor with a fingerprint reader yet but I will be following this thread to see if a answer is provided for you.

Re: Security flaw with GlobalProtect?

pasmartin — Thu, 23 Oct 2014 12:11:18 GMT

Ah, sorry, I guess I could have explained it a little better.
Ok, thanks. I guess, at least it should be made possible to turn this setting on/off (remove the possibility of selecting the GP icon), and/or include the fingerprint information (or whatever two-factor authentication used) with the GP authentication, if it's even possible(?).

Re: Security flaw with GlobalProtect?

pulukas — Sat, 20 Feb 2016 13:25:29 GMT

This is a Windows issue not GP. GP is using the windows authorized toolkit to allow VPN login from the main prompt. If this tool is built such that it bypasses two factor when implemented then MS will need to change the handling of the login request in Windows. There is nothing that GP can do to change this behavior.

Re: Security flaw with GlobalProtect?

Brandon_Wertz — Mon, 22 Feb 2016 16:28:56 GMT

I agree with @pulukas. Seem like @pasmartin should get ahold of your Enterprise TAM and get a ticket open with M$.