Subject: [hrpc] Cases - VPN

From: Nex <[email-masked]>
Date: Wed, 14 Oct 2015 21:55:13 +0200

Hello,

Here are some brief considerations on the privacy and security
properties of VPNs. There are more considerations to be made and a lot
more technical details to get into, but I hope this could be a good start.

Best,
C.

---

# Virtual Private Network

## Introduction

A Virtual Private Network (VPN) is a point-to-point connection that
enables two computers to communicate over an encrypted tunnel. There are
multiple implementations and protocols used in provisioning a VPN, and
they generally diversify by encryption protocol or particular
requirements, most commonly in proprietary and enterprise solutions.
VPNs are used commonly either to enable some devices to communicate
through peculiar network configurations, or in order to use some privacy
and security properties in order to protect the traffic generated by the
end user; or both. VPNs have also become a very popular technology among
human rights defenders, dissidents, and journalists worldwide to avoid
local illegitimate wiretapping and eventually also to circumvent
censorship. Among human rights defenders VPNs are often debated as a
potential alternative to Tor or other anonymous networks. Such
comparison is mislead, as some of the privacy and security properties of
VPNs are often misunderstood by less tech-savvy users, which could
ultimately lead to unintended problems.

As VPNs increased in popularity, commercial VPN providers have started
growing in business and are very commonly picked by human rights
defenders and people at risk, as they are normally provided with an
easy-to-use service and sometimes even custom applications to establish
the VPN tunnel. Not being able to control the configuration of the
network, and even less so the security of the application, assessing the
general privacy and security state of common VPNs is very hard. Often
such services have been discovered leaking information, and their custom
applications have been found flawed. While Tor and similar networks
receive a lot of scrutiny from the public and the academic community,
commercial or non-commercial VPN networks are way less analyzed and
understood, and it might be valuable to establish some standards to
guarantee a minimal level of privacy and security to those who need them
the most.

## False sense of Anonymity

One of the common misconception among users of VPNs is the level of
anonymity VPN can provide. This sense of anonymity can be betrayed by a
number of attacks or misconfugrations of the VPN provider. It is
important to remember that, contrarily to Tor and similar systems, VPN
was not designed to provide anonymity properties. From a technical point
of view, the VPN might leak identifiable information, or might be
subject of correlation attacks that could expose the originating address
of the connecting user. Most importantly, it is vital to understand that
commercial and non-commercial VPN providers are bound by the law of the
jurisdiction they reside in or in which their infrastructure is located,
and they might be legally forced to turn over data of specific users if
legal investigations or intelligence requirements dictate so. In such
cases, if the VPN providers retain logs, it is possible that the
information of the user is provided to the user's adversary and leads to
his or her identification.

## Logging

With VPN being point-to-point connections, the service providers are in
fact able to observe the original location of the connecting users and
they are able to track at what time they started their session and
eventually also to which destinations they're trying to connect to. If
the VPN providers retain logs for long enough, they might be forced to
turn over the relevant data or they might be otherwise compromised,
leading to the same data getting exposed. A clear log retaining policy
could be enforced, but considering that countries enforce very different
levels of data retention policies, VPN providers should at least be
transparent on what information do they store and for how long is being
kept.

## 3rd Party Hosting

VPN providers very commonly rely on 3rd parties to provision the
infrastructure that is later going to be used to run VPN endpoints. For
example, they might rely on external dedicated server hosting providers,
or on uplink providers. In those cases, even if the VPN provider itself
isn't retaining any significant logs, the information on the connecting
users might be retained by those 3rd parties instead, introducing an
additional collection point for the adversary.

## IPv6 Leakage

Some studies proved that several commercial VPN providers and
applications suffer of critical leakage of information through IPv6 due
to improper support and configuration[1]. This is generally caused by a
lack of proper configuration of the client's IPv6 routing tables.
Considering that most popular browsers and similar applications have
been supporting IPv6 by default, if the host is provided with a
functional IPv6 configuration, the traffic that is generated might be
leaked if the VPN application isn't designed to manipulate such traffic
properly.

## DNS Leakage

Similarly, VPN services that aren't handling DNS requests and are not
running DNS servers of their own, might be prone to DNS leaking which
might not only expose sensitive information on the activity of the user,
but could also potentially lead to DNS hijacking attacks and following
compromises.

## Traffic Correlation

As revelations of mass surveillance have been growing in the press,
additional details on attacks on secure Internet communications have
come to the public's attention. Among these, VPN appeared to be a very
interesting target for attacks and collectiong efforts. Some
implementations of VPN appear to be particularly vulnerable to
identification and collection of key exchanges which, some Snowden
documents revealed, are systematically collected and stored for future
reference. The ability of an adversary to monitor network connections at
many different points over the Internet, can allow them to perform
traffic correlation attacks and identify the origin of certain VPN
traffic by cross referencing the connection time of the user to the
endpoint and the connection time of the endpoint to the final
destination. These types of attacks, although very expensive and
normally only performed by very resourceful adversaries, have been
documented[2] to be already in practice and could completely vanify the
use of a VPN and ultimately expose the activity and the identity of a
user at risk.

[1] http://www.eecs.qmul.ac.uk/~hamed/papers/PETS2015VPN.pdf
[2]
http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html