Blind In/On-Path Attacks and Applications to VPNs
Blind In/On-Path Attacks and Applications to VPNs
复制标题
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
William J. Tolley;Beau Kujath;Mohammad Taha Khan;Narseo Vallina-Rodriguez;Jedidiah R. Crandall
中科院分区：
文献类型：
--
作者：
William J. Tolley;Beau Kujath;Mohammad Taha Khan;Narseo Vallina-Rodriguez;Jedidiah R. Crandall
使用虚拟专用网络 (VPN) 等技术保护加密隧道内的网络协议对于数百万需要解决方案来逃避审查或保护其流量免受路径内/路径上观察者/攻击者攻击的用户来说变得越来越重要。在本文中，我们提出了来自两种威胁模型的一系列攻击：攻击者可以将欺骗数据包注入 VPN 客户端（称为客户端）的网络堆栈，攻击者可以欺骗 Internet 上的数据包并将其发送到 VPN 服务器（称为服务器端）。在这两种情况下，我们假设攻击者在路径中，并且可以随着时间的推移对加密字节或数据包进行计数。在这两种威胁模型中，我们都演示了推断通过加密 VPN 隧道转发的 TCP 连接是否存在、干扰或将数据注入到 TCP 连接中的攻击。在服务器端威胁模型中，我们还演示了一种劫持隧道 DNS 查询并完全消除 VPN 隧道保护的攻击。对于本文提出的攻击，我们（1）在数据包速率和时序方面评估其可行性； (2) 针对广泛的 VPN 技术、类型和供应商测试其适用性； (3) 考虑与现实世界攻击相关的实际问题。对于本文中提出的所有攻击，我们都遵循道德披露流程。客户端攻击已通过两个 CVE 解决，并通过一些操作系统和 VPN 客户端供应商的一系列更新部分缓解。服务器端攻击尚未得到解决，并且在我们测试的所有操作系统和 VPN 服务器上仍然可行。
Protecting network protocols within an encrypted tunnel, using technologies such as Virtual Private Networks (VPNs), is increasingly important to millions of users needing solutions to evade censorship or protect their traffic against in/on-path observers/attackers. In this paper, we present a series of attacks from two threat models: an attacker that can inject spoofed packets into the network stack of a VPN client (called client-side), and an attacker that can spoof packets on the Internet and send them to a VPN server (called server-side). In both cases, we assume that the attacker is in/on-path, and can count encrypted bytes or packets over time. In both threat models, we demonstrate attacks to infer the existence of, interfere with, or inject data into TCP connections forwarded through the encrypted VPN tunnel. In the server-side threat model, we also demonstrate an attack to hijack tunneled DNS queries and completely remove the protections of the VPN tunnel. For the attacks presented in this paper, we (1) assess their feasibility in terms of packet rates and timing; (2) test their applicability against a broad range of VPN technologies, types, and vendors; and (3) consider practical issues with respect to real-world attacks. We followed an ethical disclosure process for all attacks presented in this paper. Client-side attacks were addressed with two CVEs and partially mitigated by a series of updates from some operating system and VPN client vendors. Server-side attacks have not been addressed and are still feasible with all operating systems and VPN servers that we tested.