Check Point VPN flaw bypasses passwords in IKEv1

Today's episode focuses on two failures that point to the same root issue: identity controls breaking under outdated assumptions. A Check Point VPN flaw shows how legacy configurations like IKEv1 can silently become open doors, while Meta's AI-powered recovery flow demonstrates how automation can bypass core verification entirely. For security and IT leaders, the takeaway is direct. Identity is no longer confined to login systems. Any workflow that can modify access or user attributes is now part of your attack surface. That includes AI agents, support tooling, and recovery processes. At the same time, configuration debt is proving just as dangerous as unpatched software. We also cover new data on AI governance gaps, a major healthcare-related breach, MFA bypass tactics, and a critical Linux privilege escalation flaw. Learn more at https://crestvale.io

Transcript

SPEAKER_00 0:00

A legacy VPN setting is now a direct path into your network, and an AI support bot just proved how easily identity controls collapse when automation skips verification. This is the Crestvale Newsroom Daily Podcast. A critical flaw in Checkpoint VPN is letting attackers bypass authentication entirely in ICEV1 deployments, not brute force, not credential stuffing, straight past the password check. The issue sits in how authentication requests are handled. Crafted traffic can slip through and land an attacker inside your network without triggering the usual credential-based signals. If ICEv 1 is still enabled anywhere, this is not theoretical, it is an exposed door. What makes this more dangerous is how common the setup still is. ICEv 1 is legacy, but it lingers. It survives in old configs, inherited environments, and, we will get to it later, backlogs. That turns this from a patching problem into a configuration debt problem. And once an attacker is in, this is not a noisy entry. There is no password guessing to flag, no failed login trail, just internal access, which means lateral movement starts immediately. This is where perimeter trust quietly collapses. If you run checkpoint gateways, the move is simple. Patch immediately, then remove ICAV 1 entirely. Not later. Now. Because leaving it in place means you are relying on a control that no longer controls anything. Now, a different kind of failure, one that is going to show up more often. Meta's AI-powered account recovery flow allowed attackers to take over roughly 20,000 Instagram accounts. The root problem is blunt. The system let an automated tool change a core identity attribute without verifying ownership. Attackers supplied their own email. The system sent reset links to that email. Accounts were effectively handed over. This ran for weeks before it was caught. That detail matters. Because detection lag turned a bad design into a scaled incident. High value accounts were compromised and resold while the system kept working as designed. This is not just a bug, it is a category of failure. When an AI or automated flow can modify identity data, it becomes part of your authentication surface. If it is treated like customer support instead of tier zero infrastructure, you create a faster path to account takeover than your login system. And once access is gained, the blast radius is full account data. Messages, history, personal information. If you are building or deploying AI-driven support, the rule is simple. Any workflow that can change identity must enforce the same verification and monitoring as login itself. Otherwise, you are building your own bypass. Meanwhile, IBM is flagging a broader pattern. AI agents are being deployed faster than organizations can govern them. Two numbers stand out. 66% of tech leaders are accountable for AI systems they cannot fully control. And 70% say deployment is outpacing tracking. That gap is already showing up in incidents. Organizations reported an average of 54 AI agent incidents last year. A meaningful share were high severity. Many led to data exposure. This is what happens when speed outruns control. The more interesting signal is on the other side. Companies that build governance into the system see fewer incidents and can actually deploy more agents safely. So this is not about slowing down. It is about shifting where control lives. If governance is layered on after deployment, risk scales with every new agent. If it is built in, scale becomes manageable. Right now, most environments are still in the first category. Here is what else is worth knowing today. Dashlane disclosed that attackers brute force two-factor flows to register rogue devices and pull encrypted vaults. It is a reminder that weak MFA implementations fail under targeted automation. DentaQuest reported a breach affecting 2.6 million records tied to Shiny Hunters. Identity data tied to healthcare continues to be highly resellable and useful for follow-on fraud. A Linux kernel privilege escalation bug shipped with a working exploit across major distributions. Any unpatched server is one local foothold away from full root access. Connect Secure introduced risk-based patch orchestration for managed service providers. Patching is moving toward threat prioritized automation rather than fixed schedules. Aviva flagged a rise in AI-generated fraud and ghost broking. Synthetic identities and fake documents are scaling faster than most detection systems can keep up. Before we close out, here is a quick look at where markets landed. Equities closed higher in the previous session, with both SPY and QQQ moving up together. The 10-year yield also pushed higher, continuing the recent upward drift. In commodities and digital assets, Bitcoin moved higher, oil climbed as well, gold pulled back. Here is the takeaway. If a system can change identity or grant access, it must be treated as part of your authentication layer, no exceptions. Tomorrow we are watching how organizations start locking down AI driven workflows as identity infrastructure, not support tooling. If this was useful, follow the Crestvale Newsroom Daily Podcast so you don't miss it. Thanks for listening.