Client-Side Vulnerabilities in Commercial VPNs

Siddharth Rao; Tien Bui; Markku Antikainen; Tuomas Aura

doi:10.1007/978-3-030-35055-0_7

Client-Side Vulnerabilities in Commercial VPNs

Siddharth Rao, Tien Bui, Markku Antikainen, Tuomas Aura

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Scientific › peer-review

Abstract

Internet users increasingly rely on commercial virtual private network (VPN) services to protect their security and privacy. The VPN services route the client’s traffic over an encrypted tunnel to a VPN gateway in the cloud. Thus, they hide the client’s real IP address from online services, and they also shield the user’s connections from perceived threats in the access networks. In this paper, we study the security of such commercial VPN services. The focus is on how the client applications set up VPN tunnels, and how the service providers instruct users to configure generic client software. We analyze common VPN protocols and implementations on Windows, macOS and Ubuntu. We find that the VPN clients have various configuration flaws, which an attacker can exploit to strip off traffic encryption or to bypass authentication of the VPN gateway. In some cases, the attacker can also steal the VPN user’s username and password. We suggest ways to mitigate each of the discovered vulnerabilities.

Original language	English
Title of host publication	Secure IT Systems
Subtitle of host publication	24th Nordic Conference, NordSec 2019, Aalborg, Denmark, November 18–20, 2019, Proceedings
Publisher	Springer
Pages	103-119
Number of pages	17
ISBN (Electronic)	978-3-030-35055-0
ISBN (Print)	978-3-030-35054-3
DOIs	https://doi.org/10.1007/978-3-030-35055-0_7
Publication status	Published - 2019
MoE publication type	A4 Conference publication
Event	Nordic Conference on Secure IT Systems - Aalborg, Denmark Duration: 18 Nov 2019 → 20 Nov 2019 Conference number: 24 https://nordsec2019.cs.aau.dk/

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	11875
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	Nordic Conference on Secure IT Systems
Abbreviated title	NordSec
Country/Territory	Denmark
City	Aalborg
Period	18/11/2019 → 20/11/2019
Internet address	https://nordsec2019.cs.aau.dk/

Keywords

Commercial VPN
Insecure configuration
client-side vulnerabilities

Access to Document

10.1007/978-3-030-35055-0_7

https://link.springer.com/chapter/10.1007/978-3-030-35055-0_7

OpenUrl availability

Full text

Security Failures in Modern Software
Tuomas Aura & Markku Antikainen
14/04/2021
1 item of Media coverage
Press/Media: Media appearance

Cite this

@inproceedings{b1017e4d04f9433f960077ce5d5c984f,

title = "Client-Side Vulnerabilities in Commercial VPNs",

abstract = "Internet users increasingly rely on commercial virtual private network (VPN) services to protect their security and privacy. The VPN services route the client{\textquoteright}s traffic over an encrypted tunnel to a VPN gateway in the cloud. Thus, they hide the client{\textquoteright}s real IP address from online services, and they also shield the user{\textquoteright}s connections from perceived threats in the access networks. In this paper, we study the security of such commercial VPN services. The focus is on how the client applications set up VPN tunnels, and how the service providers instruct users to configure generic client software. We analyze common VPN protocols and implementations on Windows, macOS and Ubuntu. We find that the VPN clients have various configuration flaws, which an attacker can exploit to strip off traffic encryption or to bypass authentication of the VPN gateway. In some cases, the attacker can also steal the VPN user{\textquoteright}s username and password. We suggest ways to mitigate each of the discovered vulnerabilities.",

keywords = "Commercial VPN, Insecure configuration, client-side vulnerabilities",

author = "Siddharth Rao and Tien Bui and Markku Antikainen and Tuomas Aura",

year = "2019",

doi = "10.1007/978-3-030-35055-0_7",

language = "English",

isbn = "978-3-030-35054-3",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "103--119",

booktitle = "Secure IT Systems",

address = "Germany",

note = "Nordic Conference on Secure IT Systems, NordSec ; Conference date: 18-11-2019 Through 20-11-2019",

url = "https://nordsec2019.cs.aau.dk/",

}

Rao, S, Bui, T, Antikainen, M & Aura, T 2019, Client-Side Vulnerabilities in Commercial VPNs. in Secure IT Systems: 24th Nordic Conference, NordSec 2019, Aalborg, Denmark, November 18–20, 2019, Proceedings. Lecture Notes in Computer Science, vol. 11875, Springer, pp. 103-119, Nordic Conference on Secure IT Systems, Aalborg, Denmark, 18/11/2019. https://doi.org/10.1007/978-3-030-35055-0_7

Client-Side Vulnerabilities in Commercial VPNs. / Rao, Siddharth; Bui, Tien; Antikainen, Markku et al.
Secure IT Systems: 24th Nordic Conference, NordSec 2019, Aalborg, Denmark, November 18–20, 2019, Proceedings. Springer, 2019. p. 103-119 (Lecture Notes in Computer Science; Vol. 11875).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Scientific › peer-review

TY - GEN

T1 - Client-Side Vulnerabilities in Commercial VPNs

AU - Rao, Siddharth

AU - Bui, Tien

AU - Antikainen, Markku

AU - Aura, Tuomas

N1 - Conference code: 24

PY - 2019

Y1 - 2019

N2 - Internet users increasingly rely on commercial virtual private network (VPN) services to protect their security and privacy. The VPN services route the client’s traffic over an encrypted tunnel to a VPN gateway in the cloud. Thus, they hide the client’s real IP address from online services, and they also shield the user’s connections from perceived threats in the access networks. In this paper, we study the security of such commercial VPN services. The focus is on how the client applications set up VPN tunnels, and how the service providers instruct users to configure generic client software. We analyze common VPN protocols and implementations on Windows, macOS and Ubuntu. We find that the VPN clients have various configuration flaws, which an attacker can exploit to strip off traffic encryption or to bypass authentication of the VPN gateway. In some cases, the attacker can also steal the VPN user’s username and password. We suggest ways to mitigate each of the discovered vulnerabilities.

AB - Internet users increasingly rely on commercial virtual private network (VPN) services to protect their security and privacy. The VPN services route the client’s traffic over an encrypted tunnel to a VPN gateway in the cloud. Thus, they hide the client’s real IP address from online services, and they also shield the user’s connections from perceived threats in the access networks. In this paper, we study the security of such commercial VPN services. The focus is on how the client applications set up VPN tunnels, and how the service providers instruct users to configure generic client software. We analyze common VPN protocols and implementations on Windows, macOS and Ubuntu. We find that the VPN clients have various configuration flaws, which an attacker can exploit to strip off traffic encryption or to bypass authentication of the VPN gateway. In some cases, the attacker can also steal the VPN user’s username and password. We suggest ways to mitigate each of the discovered vulnerabilities.

KW - Commercial VPN

KW - Insecure configuration

KW - client-side vulnerabilities

U2 - 10.1007/978-3-030-35055-0_7

DO - 10.1007/978-3-030-35055-0_7

M3 - Conference contribution

SN - 978-3-030-35054-3

T3 - Lecture Notes in Computer Science

SP - 103

EP - 119

BT - Secure IT Systems

PB - Springer

T2 - Nordic Conference on Secure IT Systems

Y2 - 18 November 2019 through 20 November 2019

ER -

Client-Side Vulnerabilities in Commercial VPNs

Abstract

Publication series

Conference

Keywords

Access to Document

OpenUrl availability

Fingerprint

Press/Media

Security Failures in Modern Software

Cite this