Slashdot Mirror
Privacy Vulnerability Exposes VPN Users' Real IP Addresses (thestack.com)
An anonymous reader writes: A major security flaw which reveals VPN users' real IP addresses has been discovered by Perfect Privacy (PP). The researchers suggest that the problem affects all VPN protocols, including IPSec, PPTP and OpenVPN. The technique involves a port-forwarding tactic whereby a hacker using the same VPN as its victim can forward traffic through a certain port, which exposes the unsuspecting user's IP address. This issue persists even if the victim has disabled port forwarding. PP discovered that five out of nine prominent VPN providers that offer port forwarding were vulnerable to the attack.
This is the stupidest thing I've heard in a few days.
Yes it's probably your friend or neighbor, nobody cares about your IP address anymore.
Essentially, you are having the user connect to the internal address of the VPN server for your forwarded port, and therefore you do not go through the VPN or NAT. A good VPN service will have bound your port to the external address only, and this would not work. And the bad ones will fix this quickly, I bet.
The only requirement is that the attacker has port forwarding enabled on the same VPN network as its target. A phishing link or laced image file, for example, is then sent to the victim which leads the traffic to a port under the hacker’s control.
So... using a social engineering attack can expose the victim's IP address. Am I missing something? Cause to me this falls under the category of "Well no shit, Sherlock!" If you can convince a user to run a malicious payload, then having an IP address exposed is the least the victim's problems.
If a virtual private network's purpose is to encrypt communication between one or more end points creating a virtual network on top of physical/logical network, the tunnel must know the public (or parent) addresses of the end points. How is this a problem when anonymity is not guaranteed in the first place, particularly when a VPN requires authentication?
TFA says that it is possible to trigger a request to the VPN gateway itself, by embedding a link to its address (example: <img src=”http://1.2.3.4:12345/x.jpg”>, and that request will show the real IP.
But in order to get the real IP? the attacker must be able to eavesdrop the traffic between the victim and the VPN gateway, right?
I don't know that VPN's are supposed to hide the end IP addresses. They made a tunnel through the Internet so you can 'pretend' to be on the same Local network as the remote host. (That's the Virtual part.) They also encrypt that traffic so the Internet doesn't get to listen to what you say. (That's the Private part.)
No where in VPN do I see that it's an 'anonymizing proxy' or something else that's supposed to obfuscate either of the end-points. Sure a lot of people started using VPN's for that purpose, but claiming there's a vulnerability or flaw in IPSec or OpenVPN because it's not 'anonymizing' seems like you've missed the mark a bit.
--Welcome to the Realm of the Hawke--
Ideas like this show why VPN use was not a huge issue "Revealed: how US and UK spy agencies defeat internet privacy and security" (6 September 2013) .."
http://www.theguardian.com/wor...
".. decode the encrypted traffic certified by three major (unnamed) internet companies and 30 types of Virtual Private Network (VPN) – used by businesses to
provide secure remote access
or under the new UK net laws "Snooper's Charter: Why aren't VPNs and Tor mentioned in the Investigatory Powers Bill?" (November 5, 2015)
http://www.ibtimes.co.uk/snoop...
".. but surprisingly, nowhere in the proposal does it mention the use of Virtual Private Networks (VPN)."
What can be done? Some creative way for an internal double VPN?
This could also show that VPN use is vulnerable at a city, state, private sector or federal level/budget rather than just a shorter list of advanced nations with a domestic collect it all capability.
Domestic spying is now "Benign Information Gathering"
Please don't buy into this bullshit anymore people, this is an advertisement masquerading as a news story.
Obvious lesson to everyone - if you can't trust everyone on the network you are on then do somethign about to keep them out.
For some reason people forgot about that with a VPN and are not thinking that they are on the same network as many others on the same VPN. Part of that is because the things used to be mainly used in situations where everybody on the same VPN was logging into the same corporate, univerity or whatever network. Now since the things are being used on a commercial scale to provide some privacy or avoid stupid barriers based on geographical location (eg. audiobooks, camping equipment whatever that vendors will not sell to you based on geographical address), then your VPN address is on there with a pile of ones from other people from all over the place.
So if you are on a VPN that provides access to people you do not personally know then it's best to treat the network as if it's out naked on the wild internet. Firewall it as if there are people out there that want to violate your cute litte computer and turn it into a spambot.
People I know run two VPNs. Connect the first, then the second. Programs access the internet through the second.
now how about we have a list of all terrorist incidents and see if one religious group stands out above all others.How about you face reality instead of making snarky comments?
Exposing internal IP addressses to other entities inside the VPN would be the 'N' part of VPN. The Private, or 'P' part is really meant for everone else. Why are these people short a whiteboard on this?
I think you underestimate just how much I just dont care.
First of all this assumes the VPN incoming and outgoing IP is the same. This would be expected if you're using your home router as your VPN as you have only one IP but I don't think it should be for larger commercial providers, especially if you're using them to "hide you".
Then it assumes the attacker can open ports on that IP (as a feature offered by the provider). If you connect to that IP:port you'll be doing it over your normal non-encrypted interface because of the way the routing table is configured on your machine.
This is easy to prevent and if you are using the VPN to "hide" you should already have such mechanisms in place (mostly to make sure you aren't leaking packets over your normal interface once your VPN and the network interface/route associated with it is down). One way is to personal-firewall-limit your "problem" apps (like browser or torrent client) to the VPN interface so they can never talk over your normal network. This can still leak via more advanced attacks (is flash spawned as separated process?) so probably the only safe way would be to block in your (external to VPN machine) firewall EVERYTHING except vpn_ip:port.
PPTP is from Microsoft, champ. -PCP
If that's your goal, you should be using a SOCKS proxy. VPNs are designed for an entirely different purpose.
So while there is some truth to your statement, some people do that, their actions make about as much sense as:
Inserting a screw is often the entire purpose of a hammer, at least from a clueless standpoint.
You CAN hammer a screw in, and many people have done it. I have, once. Sometimes it works. But it would be stupid to say that a hammer is broken because it's not very good for inserting screws. It's the wrong tool for the job. If you want to install screws, use a screwdriver. If you want to have traffic for a particular application (such as browsing or BitTorrent) come through a different IP, use a proxy. If you want to securely access a LAN remotely, use a VPN.
While I know that it has become popular to use VPN services as a method of trying to achieve anonymity, almost exclusively for circumvention and subversion, that was never a design goal of VPNs.
The purpose of VPNs was to create a private network where machines could exchange data without interception. IP addresses are almost completely irrelevant in this use case. The intent was to secure the content of the data transmission, not to hide your identity as a software pirate or to conceal your location from Netflix.
IPSec and openVPN remain perfectly fit for purpose. PPTP was always crap, but even it remains fit for purpose. That your desired pupprpose is more akin to the design goals of ToR is not the fault of VPNs.
The point of a VPN is not to keep your local IP address secret. The point is to establish a secure connection between your computer, and a remote private network. I would argue that if a VPN kept your local IP address a secret, this would itself be a security vulnerability, from the perspective of the owner of the private network!
Reading through this, it seems like it's much more likely to be useful for targeted attacks against people who are known to be actively moving all their traffic over VPNs.
Basically if the attacker is able to host a service (via port forwarding) on the IP of the same VPN endpoint that the target is going out through, then when the target visits that service (via phishing email, malicious website linked images, etc.) the VPN service will allow the attacker to see the origin of the request.
fencepost
just a little off
> How would you go about it?
> Vpn?
> Web hosted ftp?
> Or something else?
What's the purpose, the goal? A $5 vps might be a solution, Google Drive might be. For being just like running an ftp server at home, dyndns solves the dynamic IP problem , sftp simplifies port forwarding and makes it more secure, but doesn't 100% solve the NAT issue. Some sort of vpn, possibly via an ssh port forward, to an external service may be needed if you must accept remote connctions conveniently. I suppose the actual purpose determines the best solution.
That's an interesting situation. I can certainly see a VPN with a port forward as being a reasonable solution, especially if you need a lot of storage. I'm assuming your ISP doesn't -also- offer IPv6 as well as the NAT IPv4.
SSH port forwarding is a fast, easy way to set up a VPN with port forwarding in one command. Even if you don't use it for this purpose, it's a good tool to have in your toolbox. It requires that you have a shell account internet-facing box, which might be a $5/month web hosting account. On Linux, Mac, Unix, BSD etc the command is:
ssh -R 2121:localhost:21 ShellAccountHost.com
That means connecting to port 2121 on ShellAccountHost.com actually connects to port 21 on your local machine. On Windows, you can use puTTY to SSH, including port forwards:
http://howto.ccs.neu.edu/howto...
SSH port forwarding is very flexible and you can set up new ports with one quick command. That flexibility does mean the syntax takes some getting used to. For a long time I used a script like this on my Mac to make it accessible from an internet-facing IP:
while ssh -R 2222:localhost:22 ShellAccountHost.com
do
sleep 30
done
If you have a recent iPad, there are Lightning flash drives that clip over the iPad.
A 50 GB "web hosting" account from Amerinoc.com provides FTP and http for $5-$10/month.