Skip to content
Naked Security Naked Security

Networking attack gives hijackers VPN access

Researchers have discovered a flaw in macOS, Linux, and several other operating systems that could let attackers hijack VPN connections.

Researchers have discovered a security flaw in macOS, Linux, and several other operating systems that could let attackers hijack a wide range of virtual private network (VPN) connections.

The bug, discovered by University of New Mexico researchers William J Tolley, Beau Kujath, and Jedidiah R. Crandall, lets a malicious access point or someone on the same network snoop on a user’s VPN session. The snooper can tell that they’re on a VPN and figure out what site they’re visiting. The researchers explain:

This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.

The attack begins by working out the VPN client’s virtual IP address, which is the fake IP address that a VPN gives you when you use it to pretend that you’re somewhere else. It does this by sending SYN (short for synchronization) and ACK (short for acknowledgement) packets to the device. Because it doesn’t know the device’s exact address, it sends these packets to all addresses in the virtual IP space. When this noisy attack eventually hits the victim’s machine, it will respond with a reset (RST) packet that drops the connection.

That tells the attacker that the device is using an external network connection that gives it a virtual IP address. It can then send its own RST packets. The victim machine responds with a ‘challenge ACK’, inviting its VPN to set up a new connection, and the attacker can sniff out these packets by timing them and examining their size. By analysing the packets, it can determine the in-window sequence number of the connection, which tells it what type of VPN connection the victim is using.

From there, they can work out how to inject malicious packets into the VPN connection. An attacker could use those techniques to inject malicious code into a website that could help to compromise a browser.

The bug, CVE-2019-14899, works against a variety of VPN protocols including OpenVPN and IKEv2/IPSec, along with the young upstart WireGuard P2P protocol that is angling for inclusion in the Linux kernel. It exists in Linux distributions including but not limited to Ubuntu, Fedora, Debian, Arch, Manjaro, Devuan, MX Linux, Void Linux, Slackware and Deepin. It also affects FreeBSD and OpenBSD, as well as Android, macOS, and iOS.

Having said that, the issue doesn’t seem to be an exploitable problem in all flavours of Linux. The researchers said that they couldn’t replicate it on Ubuntu versions before 19.10, for example, and pointed to a configuration update in systemd (the startup system used in many Linux distributions) made on 28 November 2018 as a possible trigger condition.

The researchers haven’t tested the vulnerability against the Tor onion routing protocol, which focuses on anonymous communications, but believe that this wouldn’t be vulnerable to the attack. That’s because Tor handles its authentication and encryption outside of the operating system kernel.

What to do

The researchers’ proposed workarounds all have problems. Turning reverse path filtering on (which would stop routing packets from inappropriate addresses) won’t solve the issue for all operating systems and the attack may still work anyway, the researchers said. Filtering bogus packets (known as bogon filtering) could interfere with local network addresses in some instances, they added.

The good news is that this is likely to be extremely hard for attackers to exploit – and those that would wish to have very little information to go on.

The best bet is to wait for a patch from your Linux distributor. The researchers have chosen not to publish a detailed paper on the hack until then.


Unclear how this works against IPsec given that it doesn’t use TCP.


AFAIK, the TCP packets are only there as a trick to find out where VPN tunnels are in use by observing the behaviour of the network stack – in other words, as an attack precursor.


Systemd is not “the heart of the Linux kernel,” lest distributions like Devuan (which doesn’t use systemd) would not exist.


I can think of many words for systemd, but will not repeat them here :-) (This is a family-friendly website, and I am a kind and gentle Slackware user.)

I have removed the words that imply Systemd is part of Linux.


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!