Jump to content
Not connected, Your IP: 3.237.46.120
Sign in to follow this  
aquarius

VPN-busting bug in iOS, Android, Linux distros, macOS, FreeBSD, OpenBSD. AirVPN affected ?

Recommended Posts

Hi,
I just heard about this new VPN vulnerability:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14899
https://www.theregister.co.uk/2019/12/06/vpnbusting_bug_spotted/
 

Quote
Tricky VPN-busting bug lurks in iOS, Android, Linux distros, macOS, FreeBSD, OpenBSD, say university eggheads
OpenVPN, WireGuard, IKEv2/IPSec also vulnerable to tampering flaw, we're told

A bug in the way Unix-flavored systems handle TCP connections could put VPN users at risk of having their encrypted traffic hijacked, it is claimed.

Should I be worried, is AirVPN affected by this ?

Share this post


Link to post

Hello!

Let's see the paper first. It will be published after the vulnerability has been patched.

A paragraph from The Register says: ""This vulnerability works against OpenVPN, WireGuard, and IKEv2/IPSec, but has not been thoroughly tested against tor, but we believe it is not vulnerable since it operates in a SOCKS layer and includes authentication and encryption that happens in userspace," which is enigmatic because OpenVPN works in the userspace too, with encryption handled by OpenSSL or mbedTLS libraries.

EDIT: however, tun interface lives in the kernel space.

Kind regards
 

Share this post


Link to post

I'm no expert, but it looks like the "issue" does not depend on who your VPN provider is.  It also looks like the attacker would have to be inside your local network.  Generally it looks like the attack is so complicated and unlikely that it reminds me of an unfortunate fellow I know who has OCD, obsessive-compulsive disorder, who became obsessed with the fact that while walking home from a convenience store, a falling leaf had touched the straw of the drink he was carrying.  He became afraid to drink further because of the hypothetical possibility that a raccoon might have stepped on the leaf, and that raccoon may have had a particular parasite infection that raccoons can carry, and that an egg of the parasite might have been on the raccoon's foot, might have transferred to the leaf, and might have ended up on his straw, and might infect him if he drank further.  Was the scenario he was worried over impossible?  No, it was not.  But was it something he needed to worry about?

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
  • Security Check
    Play CAPTCHA Audio
    Refresh Image
Sign in to follow this  

×
×
  • Create New...