Networking attack gives hijackers VPN access

Researchers have discovered a security flaw in macOS, Linux, and several other operating systems that could let attackers hijack a wide range of virtual private network (VPN) connections.

The bug, discovered by University of New Mexico researchers William J Tolley, Beau Kujath, and Jedidiah R. Crandall, lets a malicious access point or someone on the same network snoop on a user’s VPN session. The snooper can tell that they’re on a VPN and figure out what site they’re visiting. The researchers explain:

This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.

The attack begins by working out the VPN client’s virtual IP address, which is the fake IP address that a VPN gives you when you use it to pretend that you’re somewhere else. It does this by sending SYN (short for synchronization) and ACK (short for acknowledgement) packets to the device. Because it doesn’t know the device’s exact address, it sends these packets to all addresses in the virtual IP space. When this noisy attack eventually hits the victim’s machine, it will respond with a reset (RST) packet that drops the connection.

That tells the attacker that the device is using an external network connection that gives it a virtual IP address. It can then send its own RST packets. The victim machine responds with a ‘challenge ACK’, inviting its VPN to set up a new connection, and the attacker can sniff out these packets by timing them and examining their size. By analysing the packets, it can determine the in-window sequence number of the connection, which tells it what type of VPN connection the victim is using.

From there, they can work out how to inject malicious packets into the VPN connection. An attacker could use those techniques to inject malicious code into a website that could help to compromise a browser.

The bug, CVE-2019-14899, works against a variety of VPN protocols including OpenVPN and IKEv2/IPSec, along with the young upstart WireGuard P2P protocol that is angling for inclusion in the Linux kernel. It exists in Linux distributions including but not limited to Ubuntu, Fedora, Debian, Arch, Manjaro, Devuan, MX Linux, Void Linux, Slackware and Deepin. It also affects FreeBSD and OpenBSD, as well as Android, macOS, and iOS.

Having said that, the issue doesn’t seem to be an exploitable problem in all flavours of Linux. The researchers said that they couldn’t replicate it on Ubuntu versions before 19.10, for example, and pointed to a configuration update in systemd (the startup system used in many Linux distributions) made on 28 November 2018 as a possible trigger condition.

The researchers haven’t tested the vulnerability against the Tor onion routing protocol, which focuses on anonymous communications, but believe that this wouldn’t be vulnerable to the attack. That’s because Tor handles its authentication and encryption outside of the operating system kernel.

What to do

The researchers’ proposed workarounds all have problems. Turning reverse path filtering on (which would stop routing packets from inappropriate addresses) won’t solve the issue for all operating systems and the attack may still work anyway, the researchers said. Filtering bogus packets (known as bogon filtering) could interfere with local network addresses in some instances, they added.

The good news is that this is likely to be extremely hard for attackers to exploit – and those that would wish to have very little information to go on.

The best bet is to wait for a patch from your Linux distributor. The researchers have chosen not to publish a detailed paper on the hack until then.