Slashdot Mirror
Privacy Vulnerability Exposes VPN Users' Real IP Addresses (thestack.com)
An anonymous reader writes: A major security flaw which reveals VPN users' real IP addresses has been discovered by Perfect Privacy (PP). The researchers suggest that the problem affects all VPN protocols, including IPSec, PPTP and OpenVPN. The technique involves a port-forwarding tactic whereby a hacker using the same VPN as its victim can forward traffic through a certain port, which exposes the unsuspecting user's IP address. This issue persists even if the victim has disabled port forwarding. PP discovered that five out of nine prominent VPN providers that offer port forwarding were vulnerable to the attack.
Essentially, you are having the user connect to the internal address of the VPN server for your forwarded port, and therefore you do not go through the VPN or NAT. A good VPN service will have bound your port to the external address only, and this would not work. And the bad ones will fix this quickly, I bet.
The only requirement is that the attacker has port forwarding enabled on the same VPN network as its target. A phishing link or laced image file, for example, is then sent to the victim which leads the traffic to a port under the hacker’s control.
So... using a social engineering attack can expose the victim's IP address. Am I missing something? Cause to me this falls under the category of "Well no shit, Sherlock!" If you can convince a user to run a malicious payload, then having an IP address exposed is the least the victim's problems.
TFA says that it is possible to trigger a request to the VPN gateway itself, by embedding a link to its address (example: <img src=”http://1.2.3.4:12345/x.jpg”>, and that request will show the real IP.
But in order to get the real IP? the attacker must be able to eavesdrop the traffic between the victim and the VPN gateway, right?
This is a mistake, then. If you want to torrent and avoid copyright holders, you need to use a SEED BOX somewhere overseas where they don't keep records. And then VPN from your home or whatever into that seed box. The box runs your torrents for you. The only traffic your IP sees is the encrypted transfers of completed files between you and the seed box. NOT VPN'd torrents.
This is of course not foolproof but it adds a nice layer between your own IP and the infringing activity. It also helps if you are on a bandwidth capped account as your connection doesn't have to support all the torrent traffic. And for cost, a seed box with VPN is not a lot more than a VPN alone. So it's not a big deal.
Well, a lot of people use vpns to hide their torrenting, and IP addresses are how copyright trolls find you and send you letters, so it kinda is an issue if you're paying for a VPN to hide your torrenting, and thus not get caught
Sig for hire.
I don't know that VPN's are supposed to hide the end IP addresses. They made a tunnel through the Internet so you can 'pretend' to be on the same Local network as the remote host. (That's the Virtual part.) They also encrypt that traffic so the Internet doesn't get to listen to what you say. (That's the Private part.)
No where in VPN do I see that it's an 'anonymizing proxy' or something else that's supposed to obfuscate either of the end-points. Sure a lot of people started using VPN's for that purpose, but claiming there's a vulnerability or flaw in IPSec or OpenVPN because it's not 'anonymizing' seems like you've missed the mark a bit.
--Welcome to the Realm of the Hawke--
Ideas like this show why VPN use was not a huge issue "Revealed: how US and UK spy agencies defeat internet privacy and security" (6 September 2013) .."
http://www.theguardian.com/wor...
".. decode the encrypted traffic certified by three major (unnamed) internet companies and 30 types of Virtual Private Network (VPN) – used by businesses to
provide secure remote access
or under the new UK net laws "Snooper's Charter: Why aren't VPNs and Tor mentioned in the Investigatory Powers Bill?" (November 5, 2015)
http://www.ibtimes.co.uk/snoop...
".. but surprisingly, nowhere in the proposal does it mention the use of Virtual Private Networks (VPN)."
What can be done? Some creative way for an internal double VPN?
This could also show that VPN use is vulnerable at a city, state, private sector or federal level/budget rather than just a shorter list of advanced nations with a domestic collect it all capability.
Domestic spying is now "Benign Information Gathering"
Exposing internal IP addressses to other entities inside the VPN would be the 'N' part of VPN. The Private, or 'P' part is really meant for everone else. Why are these people short a whiteboard on this?
I think you underestimate just how much I just dont care.
First of all this assumes the VPN incoming and outgoing IP is the same. This would be expected if you're using your home router as your VPN as you have only one IP but I don't think it should be for larger commercial providers, especially if you're using them to "hide you".
Then it assumes the attacker can open ports on that IP (as a feature offered by the provider). If you connect to that IP:port you'll be doing it over your normal non-encrypted interface because of the way the routing table is configured on your machine.
This is easy to prevent and if you are using the VPN to "hide" you should already have such mechanisms in place (mostly to make sure you aren't leaking packets over your normal interface once your VPN and the network interface/route associated with it is down). One way is to personal-firewall-limit your "problem" apps (like browser or torrent client) to the VPN interface so they can never talk over your normal network. This can still leak via more advanced attacks (is flash spawned as separated process?) so probably the only safe way would be to block in your (external to VPN machine) firewall EVERYTHING except vpn_ip:port.
This is a mistake, then. If you want to torrent and avoid copyright holders, you need to use a SEED BOX somewhere overseas where they don't keep records.
Or how about a more novel idea: Instead of paying to avoid copyright, either actually pay for the movies you watch or don't watch them. Seriously, I use a VPN and I use bittorrent for legitimate purposes, and you are ruining my ability to use my tools responsibly.
Just like the idiots that shine laser pointers at landing airplanes so now I cannot use a laser pointer to responsibly teach my daughters astronomy, you are abusing and ruining a tool for nothing of value. If you are so addicted to movies that you cannot even afford to pay for your habit, then you need counseling.
It is dangerous to be right when the government is wrong.
PPTP is from Microsoft, champ. -PCP
What about the many, many movies that never actually get released where I live (likely 20% or more never get released here, as a way of "protecting" the domestic movie producing market here)? Oh, I get it, you want me to wait until they are released on DVD and have me import them, right? Too bad about region encoding, apparently I am a "thief" for wanting to buy & watch DVD's in a different region.
I am happy to pay for content, but don't make it impossible to do so and I'll stop circumventing. Hell, the money I pay for a VPN could go to the content provider instead.
Or you could take the low-hanging fruit principle. Are studios likely to go after people who obfuscate their presence or likely to just record IP addresses and John Doe them to their nearest ISP?
I think VPN torrenters or those using SOCKS proxies will be relatively safe until everyone starts doing it.
Or how about a more novel idea: Instead of paying to avoid copyright, either actually pay for the movies you watch or don't watch them.
I tried that. No one would take my money. And 6 months later when they did want to take my money they wanted to take twice as much as normal because... well I assume they had the added cost of dubbing the original so people said "aluminium" instead of "aluminum" and had to put the missing 'u' back into various words in the subtitles. Maybe they even edited the footage so the toilets flushed in the opposite way, that would justify the cost.
If that's your goal, you should be using a SOCKS proxy. VPNs are designed for an entirely different purpose.
So while there is some truth to your statement, some people do that, their actions make about as much sense as:
Inserting a screw is often the entire purpose of a hammer, at least from a clueless standpoint.
You CAN hammer a screw in, and many people have done it. I have, once. Sometimes it works. But it would be stupid to say that a hammer is broken because it's not very good for inserting screws. It's the wrong tool for the job. If you want to install screws, use a screwdriver. If you want to have traffic for a particular application (such as browsing or BitTorrent) come through a different IP, use a proxy. If you want to securely access a LAN remotely, use a VPN.
I tried that. No one would take my money.
When regional exclusion comes into account, I for all means support copyright infringement. My comments were addressed to those who circumvent copyright when moral (not necessarily legal) means are available to them, in order to save money.
If the producers and distributors of the media do not see you as a potential customer and refuse to offer their product in your area, then you are doing no moral harm by acquiring the media by alternative distribution channels.
It is dangerous to be right when the government is wrong.
Must be pretty powerful if it can illuminate the moon.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
The point of a VPN is not to keep your local IP address secret. The point is to establish a secure connection between your computer, and a remote private network. I would argue that if a VPN kept your local IP address a secret, this would itself be a security vulnerability, from the perspective of the owner of the private network!
Self-righteous preaching is also incredibly patronizing.
Stats consistently show that not only do most pirates pay for content but tend to pay more than average. The primary reason why content gets "stolen" (MPAA/RIAA corporate propaganda) is due to the following
1. Most of the stuff people downplay they wouldn't have paid for.
2. Convenience. You can instantly get whatever you want without running through hoops of DRM and delays due to royalites.
3. A work was originally copyright protected to encourage content creation. It is not protected solely to make some guy sitting on his ass rich for doing nothing because he was lucky enough to inherit royalites. Not was it ended for some actor with a highschool diploma to make 30M a year while a doctor that saves lives makes 400K. Big media companies are behaving rotten these days. They preach values to others than milk the public dry with royalities for films, music and software that often should be in the public domain.
I'm sure plumbers, and every one else in the world whose efforts aren't protected by licensing, would like to be paid for every flush of a toilet but there comes a point where the plumber would be gouging the public.
Reading through this, it seems like it's much more likely to be useful for targeted attacks against people who are known to be actively moving all their traffic over VPNs.
Basically if the attacker is able to host a service (via port forwarding) on the IP of the same VPN endpoint that the target is going out through, then when the target visits that service (via phishing email, malicious website linked images, etc.) the VPN service will allow the attacker to see the origin of the request.
fencepost
just a little off
Bold sections and everything...
You know that no one actually cares if you use a laser pointer responsibly, right? It's a null issue. Same for your legitimate use of BitTorrent... no one is stopping you or making it harder. P2P is not illegal and there are so many trackers out there that even if it were the powers that be would never be able to stop them all. Even if they did THAT someone would just come up with something different enough to avoid the wording of law but similar enough so that you can still use it like you want to.
I think you're over reacting somewhat.
While you're on the topic of morals what's your view on the producers endlessly locking up content in copyright, forever milking the customer for every cent they can bare while passing on almost none of the profits to the people who created that work, all the while taking people to court for ludicrously over inflated payouts?
Even if I would be pirating due to financial reasons I would justify it to myself as "doing no moral harm" quite comfortably.
While you're on the topic of morals what's your view on the producers endlessly locking up content in copyright, forever milking the customer for every cent they can bare while passing on almost none of the profits to the people who created that work, all the while taking people to court for ludicrously over inflated payouts?
Even if I would be pirating due to financial reasons I would justify it to myself as "doing no moral harm" quite comfortably.
That is not the doing of the producers, rather it is the doing of the politicians. Now ask yourself what did the politicians give to the people when they took away works that should be in the public domain?
I'm all for rebelling against unjust laws, but the truth is that I'll support copyright infringement for an informative work, but not for an entertainment work. One could argue that the entertainment works become culture, to that I answer: when you pirate you are actively basing your culture on non-free works. So the society-benefiting conclusion remains: don't pirate. Just ignore the copyrighted works and base your culture upon ideas and stories that you are free to share.
It is dangerous to be right when the government is wrong.
> How would you go about it?
> Vpn?
> Web hosted ftp?
> Or something else?
What's the purpose, the goal? A $5 vps might be a solution, Google Drive might be. For being just like running an ftp server at home, dyndns solves the dynamic IP problem , sftp simplifies port forwarding and makes it more secure, but doesn't 100% solve the NAT issue. Some sort of vpn, possibly via an ssh port forward, to an external service may be needed if you must accept remote connctions conveniently. I suppose the actual purpose determines the best solution.
Yes it's probably your friend or neighbor, nobody cares about your IP address anymore.
And doxers
That's an interesting situation. I can certainly see a VPN with a port forward as being a reasonable solution, especially if you need a lot of storage. I'm assuming your ISP doesn't -also- offer IPv6 as well as the NAT IPv4.
SSH port forwarding is a fast, easy way to set up a VPN with port forwarding in one command. Even if you don't use it for this purpose, it's a good tool to have in your toolbox. It requires that you have a shell account internet-facing box, which might be a $5/month web hosting account. On Linux, Mac, Unix, BSD etc the command is:
ssh -R 2121:localhost:21 ShellAccountHost.com
That means connecting to port 2121 on ShellAccountHost.com actually connects to port 21 on your local machine. On Windows, you can use puTTY to SSH, including port forwards:
http://howto.ccs.neu.edu/howto...
SSH port forwarding is very flexible and you can set up new ports with one quick command. That flexibility does mean the syntax takes some getting used to. For a long time I used a script like this on my Mac to make it accessible from an internet-facing IP:
while ssh -R 2222:localhost:22 ShellAccountHost.com
do
sleep 30
done
If you have a recent iPad, there are Lightning flash drives that clip over the iPad.
A 50 GB "web hosting" account from Amerinoc.com provides FTP and http for $5-$10/month.
Instead of paying to avoid copyright, either actually pay for the movies you watch
I can't tell you how many times I've sat there throwing money at my television and nobody would take it. If the copyright holder won't let me buy it, then I feel no guilt about torrenting it.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
I can't tell you how many times I've sat there throwing money at my television and nobody would take it. If the copyright holder won't let me buy it, then I feel no guilt about torrenting it.
I agree with you 100%. I was addressing those who do have proper channels to acquire media.
It is dangerous to be right when the government is wrong.