But with access to a user’s computer — such as through malware — an attacker could steal those tokens and use them to gain access to a company’s network with the same level of access as the user. Password tokens used by a number of enterprise virtual private networking (VPN) apps are at risk of being targeted by hackers, the US Cybersecurity and Infrastructure Security Agency has warned. The agency claims the apps, developed by Palo Alto Networks, Cisco, F5 Networks and Pulse Secure, feature a security bug which stores both the tokens and session cookies on users’ computers. If compromised, the information could be used by attackers to remotely break into a company’s internal network. “Cisco is aware that some applications may use passwords stored in password-protected sessions or tokens, potentially exposing them to potential compromise from an attacker,” said Chris Valasek, director of product management for
Password tokens used by a number of enterprise virtual private networking (VPN) apps are at risk of being targeted by hackers, the US Cybersecurity and Infrastructure Security Agency has warned. The agency claims the apps, developed by Palo Alto Networks, Cisco, F5 Networks and Pulse Secure, feature a security bug which stores both the tokens and session cookies on users’ computers. If compromised, the information could be used by attackers to remotely break into a company’s internal network. “Cisco is aware that some applications may use passwords stored in password-protected sessions or tokens, potentially exposing them to potential compromise from an attacker,” said Chris Valasek, director of product management for