Client-Side Vulnerabilities in Commercial VPNs

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

Researchers

Research units

Abstract

Internet users increasingly rely on commercial virtual private network (VPN) services to protect their security and privacy. The VPN services route the client’s traffic over an encrypted tunnel to a VPN gateway in the cloud. Thus, they hide the client’s real IP address from online services, and they also shield the user’s connections from perceived threats in the access networks. In this paper, we study the security of such commercial VPN services. The focus is on how the client applications set up VPN tunnels, and how the service providers instruct users to configure generic client software. We analyze common VPN protocols and implementations on Windows, macOS and Ubuntu. We find that the VPN clients have various configuration flaws, which an attacker can exploit to strip off traffic encryption or to bypass authentication of the VPN gateway. In some cases, the attacker can also steal the VPN user’s username and password. We suggest ways to mitigate each of the discovered vulnerabilities.

Details

Original languageEnglish
Title of host publicationSecure IT Systems
Subtitle of host publication24th Nordic Conference, NordSec 2019, Aalborg, Denmark, November 18–20, 2019, Proceedings
Publication statusPublished - 2019
MoE publication typeA4 Article in a conference publication
EventNordic Conference on Secure IT Systems - Aalborg, Denmark
Duration: 18 Nov 201920 Nov 2019
Conference number: 24
https://nordsec2019.cs.aau.dk/

Publication series

NameLecture Notes in Computer Science
PublisherSpringer
Volume11875
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

ConferenceNordic Conference on Secure IT Systems
Abbreviated titleNordSec
CountryDenmark
CityAalborg
Period18/11/201920/11/2019
Internet address

    Research areas

  • Commercial VPN, Insecure configuration, client-side vulnerabilities

ID: 40451153