vulnerability affecting most Linux and Unix-like operating systems,
including FreeBSD, OpenBSD, macOS, iOS, and Android, that could
allow remote ‘network adjacent attackers’ to spy on and tamper with
encrypted VPN connections.
The vulnerability, tracked as CVE-2019-14899, resides in the
networking stack of various operating systems and can be exploited
against both IPv4 and IPv6 TCP streams.
Since the vulnerability does not rely on the VPN technology
used, the attack works against widely implemented virtual private
network protocols like OpenVPN, WireGuard, IKEv2/IPSec, and more,
the researchers confirmed.
This vulnerability can be exploited by a network attacker —
controlling an access point or connected to the victim’s network —
just by sending unsolicited network packets to a targeted device
and observing replies, even if they are encrypted.
As explained by the researchers, though there are variations for
each of the impacted operating systems, the vulnerability allows
attackers to:
- determine the virtual IP address of a victim assigned by the
VPN server, - determine if there is an active connection to a given
website, - determine the exact seq and ack numbers by counting encrypted
packets and/or examining their size, and - inject data into the TCP stream and hijack connections.
“The access point can then determine the virtual IP of the victim
by sending SYN-ACK packets to the victim device across the entire
virtual IP space,” the team said in its advisory[1].
“When a SYN-ACK is sent to the correct virtual IP on the victim
device, the device responds with a RST; when the SYN-ACK is sent to
the incorrect virtual IP, nothing is received by the attacker.”
systems, as an example, researchers said the attack does not work
against macOS/iOS devices as described.
Instead, an attacker needs to “use an open port on the Apple
machine to determine the virtual IP address.” In their testing, the
researchers use “port 5223, which is used for iCloud, iMessage,
FaceTime, Game Center, Photo Stream, and push notifications,
etc.”
against the following operating systems and the init systems, but
they believe this list could go long as researchers test the flaw
on more systems.
- Ubuntu 19.10 (systemd)
- Fedora (systemd)
- Debian 10.2 (systemd)
- Arch 2019.05 (systemd)
- Manjaro 18.1.1 (systemd)
- Devuan (sysV init)
- MX Linux 19 (Mepis+antiX)
- Void Linux (runit)
- Slackware 14.2 (rc.d)
- Deepin (rc.d)
- FreeBSD (rc.d)
- OpenBSD (rc.d)
“Most of the Linux distributions we tested were vulnerable,
especially Linux distributions that use a version of systemd pulled
after November 28th of last year, which turned reverse path
filtering off,” the researchers said.
“However, we recently discovered that the attack also works
against IPv6, so turning reverse path filtering on isn’t a
reasonable solution.”
As possible mitigation, researchers suggested to turn on reverse
path filtering, implement bogon filtering, and encrypt packet size
and timing to prevent attackers from making any inference.
While the researchers have not yet revealed technical details of
the vulnerability, they are planning to publish an in-depth
analysis of this flaw and its related implications, after affected
vendors, including Systemd, Google, Apple, OpenVPN, WireGuard, and
different Linux distros issue satisfactory workarounds and
patches.
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/yNn_RjYXLEQ/linux-vpn-hacking.html