6 ms·

> Zerotier promptly addressed the root server identity verification issues. This attack is still possible (as of 20/09/2021); however, an attacker is required t

> Zerotier promptly addressed the root server identity verification issues. This attack is still possible (as of 20/09/2021); however, an attacker is required to invest significant compute time (many many years with a single RTX2070) to generate a valid identity that collides with an intended target. Zerotier client’s still accept any identity learned via WHOIS packet as implicitly valid. It also says below that the main vuln is fixed... Can't now figure out if I should be worried or not...

andag 5y ago
> This attack is still possible (as of 20/09/2021); however, an attacker is required to invest significant compute time (many many years with a single RTX2070) to generate a valid identity So it's entirely feasible if you have access to any cloud vendor then.
- Uberphallus 5y ago
  > So it's entirely feasible if you have access to any cloud vendor then. At around $0.50 per hour, and assuming "many many years" means 10 years, then the attack needs to be worth those $43800.
  - m_eiman 5y ago
    Many many means 512 in the article. But that's with lots of room for optimizations.
  - fragmede 5y ago
    That's... less than I expected? Certainly more expensive that a normal person could afford, but with the levels of income disparity in the US, that's frighteningly affordable for a large corporation and within reach for highly motivated rich individual. If you own a cloud (aka Amazon wants to break into your VPN), they get major discounts on time on their fleet. If, instead, it costs $0.01/hr due to using unused capacity during quiet times of day, that's works out to be like $1000 to crack it. As to what makes it worth it. $50k is too expensive to attack all users of this particular VPN software, but there's way more than $50k worth of information companies want to keep secret (call it competitive intelligence) being protected by VPN software the world over.
- m_eiman 5y ago
  In addition to the compute power, you also need som other things: "An attacker would need to hijack the address for a peer that has been offline for 30 days or communicate only with other peers that do not have a cached identity for the hijacked address."
  - _hyn3 5y ago
    If you have access to the victim's ZeroTier dashboard (or API calls), that's trivial to get. Even if there are currently no disclosed vulns in the dashboard, that doesn't mean that none exist.
mistaken 5y ago
What worries me is that 2 months have passed since the vulnerability was fixed and yet there is no new version released which contains the patch... So you're exposed unless you build ZT from source.
- m4lvin 5y ago
  If the problem is in the ZT root servers, then the clients do not need to be patched, I guess?
- api 5y ago
  The patch was on the roots and was applied within 6 hours of learning of the vulnerability. A new release wasn't needed since the issue was not in there.
- mistaken 5y ago
  A new packaged version is now available. zerotier-one (1.6.6) unstable; urgency=medium * Backport endpoint mitigation against address collision attack. -- Adam Ierymenko <adam.ierymenko@zerotier.com> Tue, 21 Sep 2021 01:00:00 -0700
Griffinsauce 5y ago
> many many years with a single RTX2070 Unless they're lucky.
- midasuni 5y ago
  If you’re lucky you can break any encryption in under a second by pulling the key from /dev/urandom. It’s a meaningless statement without defining how lucky.
  - fragmede 5y ago
    If it takes 2 years to exhaustively search the entire keyspace, you'd expect to be 50% lucky a year in, assuming the keys are evenly distributed (which is a huge assumption). If you have a lot of keys to crack and it's a feasibly short time, mean time to brute-force key recovery becomes far more interesting to you than the worst case scenario.
    - midasuni 5y ago
      Which is why saying “if your lucky” isn’t helpful, but quoting time to exhaust keyspace (knowing that half the time you’ll get it in half the time) is more useful
_kbh_ 5y ago
unless the number of years that compute time is measured in has a lot of digits (like 3 or more) I wouldn't be comfortable. a RTX2070 isn't even the fastest card available now, let alone in the next generation or two. Compute performance for video cards is still rapidly scaling and that means that if the "many many years" isn't large enough it may not even be years soon enough.
downrightmike 5y ago
I kind of wish that the metric would be X hours on MSFT or Google's largest available cluster.

andag 5y ago

> This attack is still possible (as of 20/09/2021); however, an attacker is required to invest significant compute time (many many years with a single RTX2070) to generate a valid identity So it's entirely feasible if you have access to any cloud vendor then.

Uberphallus 5y ago
> So it's entirely feasible if you have access to any cloud vendor then. At around $0.50 per hour, and assuming "many many years" means 10 years, then the attack needs to be worth those $43800.
- m_eiman 5y ago
  Many many means 512 in the article. But that's with lots of room for optimizations.
- fragmede 5y ago
  That's... less than I expected? Certainly more expensive that a normal person could afford, but with the levels of income disparity in the US, that's frighteningly affordable for a large corporation and within reach for highly motivated rich individual. If you own a cloud (aka Amazon wants to break into your VPN), they get major discounts on time on their fleet. If, instead, it costs $0.01/hr due to using unused capacity during quiet times of day, that's works out to be like $1000 to crack it. As to what makes it worth it. $50k is too expensive to attack all users of this particular VPN software, but there's way more than $50k worth of information companies want to keep secret (call it competitive intelligence) being protected by VPN software the world over.
m_eiman 5y ago
In addition to the compute power, you also need som other things: "An attacker would need to hijack the address for a peer that has been offline for 30 days or communicate only with other peers that do not have a cached identity for the hijacked address."
- _hyn3 5y ago
  If you have access to the victim's ZeroTier dashboard (or API calls), that's trivial to get. Even if there are currently no disclosed vulns in the dashboard, that doesn't mean that none exist.

mistaken 5y ago

What worries me is that 2 months have passed since the vulnerability was fixed and yet there is no new version released which contains the patch... So you're exposed unless you build ZT from source.

m4lvin 5y ago
If the problem is in the ZT root servers, then the clients do not need to be patched, I guess?
api 5y ago
The patch was on the roots and was applied within 6 hours of learning of the vulnerability. A new release wasn't needed since the issue was not in there.
mistaken 5y ago
A new packaged version is now available. zerotier-one (1.6.6) unstable; urgency=medium * Backport endpoint mitigation against address collision attack. -- Adam Ierymenko <adam.ierymenko@zerotier.com> Tue, 21 Sep 2021 01:00:00 -0700

Griffinsauce 5y ago

> many many years with a single RTX2070 Unless they're lucky.

midasuni 5y ago
If you’re lucky you can break any encryption in under a second by pulling the key from /dev/urandom. It’s a meaningless statement without defining how lucky.
- fragmede 5y ago
  If it takes 2 years to exhaustively search the entire keyspace, you'd expect to be 50% lucky a year in, assuming the keys are evenly distributed (which is a huge assumption). If you have a lot of keys to crack and it's a feasibly short time, mean time to brute-force key recovery becomes far more interesting to you than the worst case scenario.
  - midasuni 5y ago
    Which is why saying “if your lucky” isn’t helpful, but quoting time to exhaust keyspace (knowing that half the time you’ll get it in half the time) is more useful

_kbh_ 5y ago

unless the number of years that compute time is measured in has a lot of digits (like 3 or more) I wouldn't be comfortable. a RTX2070 isn't even the fastest card available now, let alone in the next generation or two. Compute performance for video cards is still rapidly scaling and that means that if the "many many years" isn't large enough it may not even be years soon enough.

downrightmike 5y ago

I kind of wish that the metric would be X hours on MSFT or Google's largest available cluster.