Vpwns : Virtual Pwned Networks

Vpwns : Virtual Pwned Networks Citation for published version (APA): Appelbaum, J., Ray, M., Koscher, K., & Finder, I. (2012). Vpwns : Virtual Pwned Networks. In 2nd USENIX Workshop on Free and Open Communications on the Internet, FOCI '12, Bellevue, WA, USA, August 6, 2012 https://www.usenix.org/conference/foci12/workshop-program/presentation/appelbaum Document status and date: Published: 01/01/2012 Document Version: Publisher’s PDF, also known as Version of Record (includes final page, issue and volume numbers) Please check the document version of this publication: • A submitted manuscript is the version of the article upon submission and before peer-review. There can be important differences between the submitted version and the official published version of record. People interested in the research are advised to contact the author for the final version of the publication, or visit the DOI to the publisher's website. • The final author version and the galley proof are versions of the publication after peer review. • The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal. If the publication is distributed under the terms of Article 25fa of the Dutch Copyright Act, indicated by the “Taverne” license above, please follow below link for the End User Agreement: www.tue.nl/taverne Take down policy If you believe that this document breaches copyright please contact us at: [email protected] providing details and we will investigate your claim. Download date: 27. Sep. 2021 vpwns: Virtual Pwned Networks Jacob Appelbaum Marsh Ray Security and Privacy Research Lab PhoneFactor, Inc. University of Washington & The Tor Project [email protected] [email protected] Karl Koscher Ian Finder Security and Privacy Research Lab Security and Privacy Research Lab University of Washington University of Washington [email protected] [email protected] Abstract participate in the economies of scale of the public in- User-accessed Virtual Private Network systems allow au- ternet, today are often used for purposes beyond merely thorized users remote access to protected or otherwise connecting private networks together. The availability of privileged networks while avoiding dependence on ISPs mature VPN implementations and the encryption and ac- along the route for data confidentiality and integrity. This cess control they provide would seem to make VPNs an direct expression of the internet’s end-to-end principle of attractive option for systems that provide user anonymity security is generally accepted as a highly successful de- or resist censorship. Nevertheless, many anonymity and sign. censorship circumvention systems that are built on top VPN services and technology advertising censor- of VPNs are easily subverted by active (and sometimes ship circumvention, resistance to data retention, and passive) attacks. Even with the best cryptography and anonymity as features are proliferating rapidly. But it careful coding practices, the security of the VPN may be is unclear that these security properties were included bypassed entirely. in the original design requirements of VPN protocols The anonymity community often ignores VPN-based and product implementations. Experience with dedi- solutions, considering them obviously flawed against cated anonymity networks (e.g., Tor) shows that strong strong attackers. Nevertheless, these solutions are rou- anonymity is not achieved by accident. The ‘P’ in VPN tinely employed by users who believe the claims of ven- notwithstanding, not all privacy methods are equal or dors. strongly anonymizing, which opens opportunities for at- Whenever a tool is pressed into service to provide data tackers when VPN-based systems are used for anonymity security properties for which it was not originally de- or even simple censorship circumvention. signed and tested, the potential for subtle security flaws This paper evaluates VPN anonymity, security and greatly increases. In the particular case of a VPN used privacy features including identity, geographic location, as an anonymizing service, the issues seem to arise pri- confidentiality of communications, and generalized se- marily from the conventional relationship the VPN client curity issues such as reachability and prevention of net- software has with the endpoint system’s routing table. work tampering. We find many popular VPN prod- After all, to the kernel it is “simply another network”, ucts are susceptible to a variety of practical user de- so the most common VPN implementation technique is anonymization attacks. Weaknesses stem from lack of for the active VPN connection to appear to the system as security analysis of the composition of VPNs, applica- another virtual network adapter. Consequently, enforce- tions, and the TCP/IP stack on each respective operat- ment and application of many VPN security properties ing system. Although we describe some potential miti- depend greatly on the local routing table. gations for vendors, the primary goal of this paper is to Applications generally prefer to remain unaware of raise awareness of the inherent risks which come from network state changes, at best they might implement repurposing off-the-shelf VPN systems to provide strong some notion of an “offline” mode. Because monitoring anonymity. the changes in the lower layers of the network stack is not an important goal in computing for most users, user 1 Introduction interfaces tend to minimize such details as long as basic connectivity is working. But these networking subsys- Virtual Private Network systems (VPNs), although orig- tem properties that are unimportant details under normal inally conceived as a tool to enable private networks to circumstances silently become security-critical consider- ations once the user begins relying upon the routing table 3.1 Use cases to ensure their anonymity. Many VPN providers or products seem to promise per- fect privacy and security. They rarely define cohesive threat models or explain details about the security eval- 2 VPN Security Mechanisms uations they expect users to make. It is exceedingly rare to find a provider or product development team that Routing table based network security is normally a per- discloses such threat model discussions or evaluations fectly acceptable architecture for classic VPN deploy- openly. In many cases the VPN vendors do not properly ment scenarios: if the routing table is wrong, the packet deploy SSL/TLS for their general websites or download simply cannot be delivered. Even when an unencrypted sites. packet does manage to escape via a physical interface, We consider users to belong to four primary use cases: usually it bears an RFC 1918 [3] private use address on • Users who require access to internal or otherwise either the source or destination so the packet is not likely protected resources to make it very far outside of the trusted network. Those • Users who wish to avoid Firesheep [11] or other who depend on such systems will eventually notice the small attackers (e.g., cafs Wi-Fi sniffing) failed connections, complain to their network adminis- • Users who wish to access the wider internet without trator and the misconfiguration will be resolved. censorship or surveillance But when the goal of the system is to provide strong • Users who wish to reposition themselves into differ- user anonymity, the requirements become much more ent legal frameworks (e.g., geographically limited stringent. Even a single leaked DNS query or TCP SYN content). packet may be enough to reveal the user’s identity entirely and subject them to consequences much greater than those of a failed connection. Under these new re- 4 Security Implementation Realities quirements, the method of securing traffic via the endpoint system’s routing table is insufficient. It proves vul- The security realities of VPN deployments diverge sig- nerable to a number of generic problems that have the ef- nificantly from the claims made by vendors. fect of expanding the user’s attack surface dramatically. When a client connects to or disconnects from a VPN service, a significant amount of reconfiguration must be performed on the client network stack. In order for ef- 3 Security Claims and Properties fective anonymity to be achieved most of this reconfiguration must complete successfully. Device drivers must Many VPN providers or products seem to overpromise be loaded and unloaded, routing tables and name reso- in terms of where their products and tools work, mak- lution settings must be adjusted, some existing connec- ing extremely bold claims about privacy, security, and tions must be dropped, and some applications restarted. anonymity without having had their claims evaluated to To this end, many VPN systems provide custom client the standards found in the anonymity community. software. Some VPN client packages provide rich func- For example, AnchorFree’s Hotspot Shield website [7] tionality, allowing desktop settings to be reconfigured or claims the following: even arbitrary scripts pushed to the client to be executed with Administrator privileges. For example, a corporate • “VPN encrypts all traffic.” VPN, may require a qualifying anti-malware package be • “Protect yourself in Wi-Fi hotspots.” installed and client OS updates be applied before allow- • “Hide your IP and ensure anonymous browsing.” ing clients access to the network. • “Protect yourself from snoopers at Wi-Fi hotspots, The term ‘split tunnel’ refers to the technique of pass- hotels, airports, corporate offices.” ing some, but not all, net traffic over the VPN.

Load more