Sophos Connect 2 - security concerns
Hello,
when opening a Sophos VPN connection, the credentials are displayed in cleartext:
ist there a way to hide this?
Second thing is - how does the process work? How are the credentials transmitted to the client?
Is there a possibility to "sniff" the commandline/credentials, even if the cmd box is not displayed and if yes, how could this get hardened?
Best regards,
Daniel
All Comments (17)
Hello,
We will investigate if any improvements can be made to this module.
Sometimes command line arguments can get logged in the system's event viewer and/or the task manager process list.
Regards,
Mathieu Morrissette
Hello Mathieu,
thanks! Exactly this "Sometimes command line arguments can get logged in the system's event viewer and/or the task manager process list." ist also an important point.
Best regards,
Daniel
Hello,
is there any update yet?
Best regards,
Daniel
Hello,
Thank you for the follow-up.
Based on the internal case created to address this issue, it is currently in the backlog but is expected to be reviewed soon.
Best regards,
Jacob Lafrenière
Hello,
Could you confirm the file extension of the configuration file you're using?
Regards,
Gabryel Poisson
Hello,
VPN type: Sophos Connect
Version: V2
Configuration mode: Data (imported files are usualy .ovpn)
Best regards,
Daniel
Hello,
Thank you for the information.
We attempted to reproduce the issue; however, we are currently unable to do so.
We have reached out to Sophos, but unfortunately, they do not provide support or documentation for CLI-based testing in this context. Additionally, Sophos Connect requires a Sophos Firewall to function properly, and we do not have access to this product on our end.
As a result, we currently have no reliable way to simulate or reproduce the issue involving username/password prompt through the CLI.
If there are any alternative connection methods or additional reproduction steps you can share, we would be happy to try them.
Best regards,
Gabryel Poisson