Heartbleed bug exploited to bypass multifactor auth, hack VPN

Security incident response firm Mandiant has revealed that one of its clients was targeted by a Heartbleed exploit that allowed the company's virtual private network (VPN) to be breached.

While much of the public discourse about the Heartbleed threat has centered around the breach of web servers, Mandiant highlighted on Friday a different attack method leveraging the vulnerability, where multifactor authentication on VPNs could be bypassed by hackers.

Using the flaw within only 24 hours of the bug's disclosure, an attacker hacked the “major corporation” by breaking into an employee's VPN session, a Friday article in The New York Times said. Intruders then used the vulnerability to steal passwords for “broader access to the victim's network,” the outlet said.

The Heartbleed bug, made public earlier this month, is a critical vulnerability found in widely used versions of the OpenSSL library.