13 ms·

Vulnerabilities exploited in VPN products used worldwide

233 points by infodocket 7y ago

campuscodi 7y ago
The APT referenced in the NCSC alert is APT5: https://www.zdnet.com/article/a-chinese-apt-is-now-going-after-pulse-secure-and-fortinet-vpn-servers/ https://www.zdnet.com/article/a-chinese-apt-is-now-going-aft...
- dontbenebby 7y ago
  Thank you, did not want to enable JS to read...
inetknght 7y ago
> You need to enable JavaScript to run this app. Can someone provide a link to a page which isn't built by a retard?
- deleted 7y ago
  [deleted]
- m-p-3 7y ago
  IFPS mirror https://ipfs.io/ipfs/QmWux6nCqtWrYkcExi3yzrhoejfiQxK46dr6jGBC81VGez/ https://ipfs.io/ipfs/QmWux6nCqtWrYkcExi3yzrhoejfiQxK46dr6jGB... https://cloudflare-ipfs.com/ipfs/QmWux6nCqtWrYkcExi3yzrhoejfiQxK46dr6jGBC81VGez/ https://cloudflare-ipfs.com/ipfs/QmWux6nCqtWrYkcExi3yzrhoejf... PDF file at the bottom https://s3.eu-west-1.amazonaws.com/ncsc-content/files/VPN_Vulnerabilities_Alert_final.pdf https://s3.eu-west-1.amazonaws.com/ncsc-content/files/VPN_Vu...
  - dontbenebby 7y ago
    This is interesting. I wonder if I am more or less secure using an Algo VPN on AWS than a branded VPN company. (I'm assuming they don't sit on all AWS servers/have broad access hence going after less mature businesses...)
- dang 7y ago
  Can you please follow the site guidelines when posting to HN, regardless of how annoying a web page is? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
tptacek 7y ago
Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.
- ihuman 7y ago
  Why do you prefer Wireguard over Openvpn?
  - throwaway2048 7y ago
    Wireguard is an extremely simple protocol, basically as simple as it is possible for an encrypted VPN protocol to be. OpenVPN uses TLS (in TCP mode) and a custom protocol based off of TLS in UDP mode, its design is vastly over complicated by the use of x.509 certificates, and in general is just kind of ugly and kludgy (and slow).
    - tptacek 7y ago
      It's "simple" in a way that is very difficult to achieve, and in many ways more modern than OpenVPN. The better word might be "clean".
  - kachnuv_ocasek 7y ago
    There's also a formal proof of Wireguard's security (not that it means much in practice, but I find it extremely interesting): https://prosecco.gforge.inria.fr/personal/bblanche/publications/LippBlanchetBhargavanEuroSP19.pdf https://prosecco.gforge.inria.fr/personal/bblanche/publicati...
  - c22 7y ago
    I spent over two days setting up OpenVPN the first time I used it and less than an hour the first time I set up Wireguard. Wg seems a bit more reliable too, sometimes my OpenVPN sessions would time out and require manual intervention, but since switching to wireguard it always seems to "just work".
Havoc 7y ago
>These vulnerabilities are well documented in open source. Seeing this awkward use of "open source" a lot lately. Its almost as if people think "readable on the internet for free" equals open source.
- jackcodes 7y ago
  It does mean that. Free software and open source mean different things.
  - yjftsjthsd-h 7y ago
    Is this open source or source available? There is a meaningful distinction.
    - jackcodes 7y ago
      What is the distinction?
      - detaro 7y ago
        Open Source fullfills the open source definition: https://opensource.org/osd-annotated https://opensource.org/osd-annotated. Source available is software where you can look at the source, but do not have the rights you have with Open Source.
      - IggleSniggle 7y ago
        Free software follows a philosophy of “all people have a right to use computing knowledge” which has a very similar set of license scenarios but a different underlying driving culture: https://www.gnu.org/philosophy/free-sw.en.html https://www.gnu.org/philosophy/free-sw.en.html The “stricter requirements” piece is that the freedom bent sometimes leads towards more restrictive licenses (like GPL)
  - bad_user 7y ago
    No. Open source has a precise defition that is equivalent with Free Software: [1] https://opensource.org/osd-annotated https://opensource.org/osd-annotated [2] https://en.m.wikipedia.org/wiki/Open_source https://en.m.wikipedia.org/wiki/Open_source
acl777 7y ago
end users: "vulnerabilities" government security offices: "opportunities" :-)
kerng 7y ago
Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented. Companies that do BeyondCorp dont even have that level of protection. Most blindly follow that, without realizing that security of their internal systems is bad and therefore they should not do BeyondCorp. I have seen companies put their production infra without any fire walling out on the Internet (e.g jumpboxes and bastions) - that's also mind boggling. Zero Trust is a journey not a solution....
- xyzzy_plugh 7y ago
  BeyondCorp isn't incompatible with VPN solutions -- if anything they're highly complementary. Why not use both?
  - kerng 7y ago
    Exactly my point, Zero Trust is good strategy and mindset. BeyondCorp though is short sighted and seems more like a solution from a company that wants to sell its cloud sooutions, by trying to make VPN evil by suggesting you should not have a network perimeter at all: "Connecting from a particular network must not determine which services you can access." I argue, that a simple source IP check is still one of the most significant and effective defense in depth measures that can be put in place. Not doing it seems like lack of due diligence to me. Its the first level of defense to which more security needs to be added on to.
gz5 7y ago
The architecture (of classic VPN) is the vulnerability. imo, we need to move towards architectures which design in: + Least privileged access and isolation. Worst-case, 5-tuple, session-by-session. Best-case, app level bindings, independent of addressing. Isolation to prevent lateral attacks. + Zero trust. Yes the ZT term seems to have been taken over by marketing, but the architecture itself is sound. + Telemetry data for proper visibility. + Programmable-by-Design. Integrate into overall app and security constructs and tooling; no (mainly) separate VPN islands.
- pjmlp 7y ago
  And not written in C, as some of these CVEs are the typical issues C has plagued the industry with.
basicplus2 7y ago
<vulnerabilities affecting Virtual Private Network (VPN) products from vendors Pulse secure, Palo Alto and Fortinet>

233 points by infodocket 7y ago

The APT referenced in the NCSC alert is APT5: https://www.zdnet.com/article/a-chinese-apt-is-now-going-after-pulse-secure-and-fortinet-vpn-servers/ https://www.zdnet.com/article/a-chinese-apt-is-now-going-aft...

dontbenebby 7y ago
Thank you, did not want to enable JS to read...

inetknght 7y ago

> You need to enable JavaScript to run this app. Can someone provide a link to a page which isn't built by a retard?

deleted 7y ago
[deleted]
m-p-3 7y ago
IFPS mirror https://ipfs.io/ipfs/QmWux6nCqtWrYkcExi3yzrhoejfiQxK46dr6jGBC81VGez/ https://ipfs.io/ipfs/QmWux6nCqtWrYkcExi3yzrhoejfiQxK46dr6jGB... https://cloudflare-ipfs.com/ipfs/QmWux6nCqtWrYkcExi3yzrhoejfiQxK46dr6jGBC81VGez/ https://cloudflare-ipfs.com/ipfs/QmWux6nCqtWrYkcExi3yzrhoejf... PDF file at the bottom https://s3.eu-west-1.amazonaws.com/ncsc-content/files/VPN_Vulnerabilities_Alert_final.pdf https://s3.eu-west-1.amazonaws.com/ncsc-content/files/VPN_Vu...
- dontbenebby 7y ago
  This is interesting. I wonder if I am more or less secure using an Algo VPN on AWS than a branded VPN company. (I'm assuming they don't sit on all AWS servers/have broad access hence going after less mature businesses...)
dang 7y ago
Can you please follow the site guidelines when posting to HN, regardless of how annoying a web page is? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

tptacek 7y ago

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

ihuman 7y ago
Why do you prefer Wireguard over Openvpn?
- throwaway2048 7y ago
  Wireguard is an extremely simple protocol, basically as simple as it is possible for an encrypted VPN protocol to be. OpenVPN uses TLS (in TCP mode) and a custom protocol based off of TLS in UDP mode, its design is vastly over complicated by the use of x.509 certificates, and in general is just kind of ugly and kludgy (and slow).
  - tptacek 7y ago
    It's "simple" in a way that is very difficult to achieve, and in many ways more modern than OpenVPN. The better word might be "clean".
- kachnuv_ocasek 7y ago
  There's also a formal proof of Wireguard's security (not that it means much in practice, but I find it extremely interesting): https://prosecco.gforge.inria.fr/personal/bblanche/publications/LippBlanchetBhargavanEuroSP19.pdf https://prosecco.gforge.inria.fr/personal/bblanche/publicati...
- c22 7y ago
  I spent over two days setting up OpenVPN the first time I used it and less than an hour the first time I set up Wireguard. Wg seems a bit more reliable too, sometimes my OpenVPN sessions would time out and require manual intervention, but since switching to wireguard it always seems to "just work".

Havoc 7y ago

>These vulnerabilities are well documented in open source. Seeing this awkward use of "open source" a lot lately. Its almost as if people think "readable on the internet for free" equals open source.

jackcodes 7y ago
It does mean that. Free software and open source mean different things.
- yjftsjthsd-h 7y ago
  Is this open source or source available? There is a meaningful distinction.
  - jackcodes 7y ago
    What is the distinction?
    - detaro 7y ago
      Open Source fullfills the open source definition: https://opensource.org/osd-annotated https://opensource.org/osd-annotated. Source available is software where you can look at the source, but do not have the rights you have with Open Source.
    - IggleSniggle 7y ago
      Free software follows a philosophy of “all people have a right to use computing knowledge” which has a very similar set of license scenarios but a different underlying driving culture: https://www.gnu.org/philosophy/free-sw.en.html https://www.gnu.org/philosophy/free-sw.en.html The “stricter requirements” piece is that the freedom bent sometimes leads towards more restrictive licenses (like GPL)
- bad_user 7y ago
  No. Open source has a precise defition that is equivalent with Free Software: [1] https://opensource.org/osd-annotated https://opensource.org/osd-annotated [2] https://en.m.wikipedia.org/wiki/Open_source https://en.m.wikipedia.org/wiki/Open_source

acl777 7y ago

end users: "vulnerabilities" government security offices: "opportunities" :-)

kerng 7y ago

Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented. Companies that do BeyondCorp dont even have that level of protection. Most blindly follow that, without realizing that security of their internal systems is bad and therefore they should not do BeyondCorp. I have seen companies put their production infra without any fire walling out on the Internet (e.g jumpboxes and bastions) - that's also mind boggling. Zero Trust is a journey not a solution....

xyzzy_plugh 7y ago
BeyondCorp isn't incompatible with VPN solutions -- if anything they're highly complementary. Why not use both?
- kerng 7y ago
  Exactly my point, Zero Trust is good strategy and mindset. BeyondCorp though is short sighted and seems more like a solution from a company that wants to sell its cloud sooutions, by trying to make VPN evil by suggesting you should not have a network perimeter at all: "Connecting from a particular network must not determine which services you can access." I argue, that a simple source IP check is still one of the most significant and effective defense in depth measures that can be put in place. Not doing it seems like lack of due diligence to me. Its the first level of defense to which more security needs to be added on to.

gz5 7y ago

The architecture (of classic VPN) is the vulnerability. imo, we need to move towards architectures which design in: + Least privileged access and isolation. Worst-case, 5-tuple, session-by-session. Best-case, app level bindings, independent of addressing. Isolation to prevent lateral attacks. + Zero trust. Yes the ZT term seems to have been taken over by marketing, but the architecture itself is sound. + Telemetry data for proper visibility. + Programmable-by-Design. Integrate into overall app and security constructs and tooling; no (mainly) separate VPN islands.

pjmlp 7y ago
And not written in C, as some of these CVEs are the typical issues C has plagued the industry with.

basicplus2 7y ago