Virtual Private Networks (VPNs) are widely used for privacy, security, and circumventing censorship. However, a recent research paper titled "Explainer: Attacking Connection Tracking Frameworks as used by Virtual Private Networks" reveals a new vulnerability named "port shadow." This vulnerability exposes users to various attacks, including traffic hijacking, DNS redirection, and port scanning, by exploiting the connection tracking frameworks in VPN servers. In this article, we will delve into the technical aspects of this vulnerability and explain why TorGuard VPN is resilient against such attacks.
Understanding the Port Shadow Attack
The port shadow attack leverages the shared resources in VPN servers, particularly the connection tracking frameworks used by OpenVPN, WireGuard, and OpenConnect. The attack involves an adversary who shares the same VPN server as the victim. By crafting malicious packets from within their own connection and from a remote location they control, the attacker can manipulate the connection tracking framework to shadow a victim's port. This leads to various potential attacks, including:
- Snooping Unencrypted Data: Accessing domain names of websites visited by the victim.
- Connection Hijacking: Intercepting and redirecting the victim's traffic.
- Port Scanning: Scanning for open ports on the victim's device.
- Denial of Service (DoS): Disrupting the victim's VPN connection.
The researchers recommend various mitigation strategies, such as implementing firewall rules, randomizing source ports, and limiting concurrent connections. However, the fundamental shared resource design of VPN servers poses inherent challenges in completely eliminating the risk.
TorGuard's Robust Security Measures
TorGuard VPN has been designed with several security measures that effectively counteract the port shadow vulnerability. Here are the key properties of TorGuard VPN that prevent traffic hijacking and rerouting:
1. Server Intercommunication Blocking
TorGuard employs stringent intercommunication blocking at the interface level. Users connected on different protocols cannot see, communicate, or route traffic between each other. This isolation ensures that traffic from one user cannot be routed through another tunnel internally on the server, preventing cross-scans for ports and IPs.
2. Private IP Assignment
TorGuard assigns IPs in a highly controlled manner. Users with dedicated or port-forwarding requirements receive dedicated internal IPs that are either excluded from the shared pool or use a different IP subnet. This segregation protects users' IPs and open ports from being targeted by potential attackers sharing the same server.
3. Simultaneous Connection Limits
To further enhance security, TorGuard enforces strict limits on the number of concurrent VPN connections per user. This reduces the likelihood of an attacker using multiple connections to exploit the port shadow vulnerability.
4. Randomized Client Listening Port
The listening port for each client is randomly assigned by either TorGuard VPN software or the configuration tool generation. This randomness ensures that ports do not repeat, making it significantly challenging for an attacker to identify and exploit another client's listening port.
5. Connection Tracking Timeouts
TorGuard implements very low timeouts for different connection tracking aspects. This rapid timeout mechanism prevents connection hijacking after the client closes the connection, minimizing the window of opportunity for an attacker.
Complexity of Exploiting the Vulnerability on TorGuard
The complexity of executing a port shadow attack on TorGuard's infrastructure is exceptionally high, if not impossible. Several factors contribute to this difficulty:
- Lack of Knowledge of User Listening Port or Assigned IP: Without knowing the specific listening port or assigned IP of the target user, an attacker cannot initiate a targeted scan.
- Inability to Scan Internal IPs or Ports: Due to server intercommunication blocking, scanning for internal IPs or ports is infeasible.
- Short Connection Tracking Window: The brief conntrack window for packets further reduces the likelihood of successful exploitation.
- High Degree of Randomization and Isolation: The random assignment of ports and isolated network environments add layers of complexity for an attacker.
Real-World Testing and Validation
A researcher recently reached out to TorGuard, attempting to create a proof of concept (PoC) for the port shadow attack on our network. The researcher aimed to demonstrate the vulnerability using a dedicated IP. However, we advised that the internal IP assignment in such cases is unique to the user and cannot be replicated using a different VPN user account on a second device. Consequently, the researcher was unable to exploit the vulnerability.
The potential attacker would need to know the exact time the target user connected, the specific VPN IP, and the precise moment the first user disconnected. The attacker would then have to connect quickly enough to be assigned the same internal IP and rely on the conntrack not timing out. This level of precision and timing is akin to shooting for the stars, making the attack highly impractical.
Conclusion
The port shadow vulnerability highlights potential risks in shared VPN server environments. However, TorGuard's comprehensive security measures effectively mitigate these risks, ensuring robust protection for our users. Our implementation of server intercommunication blocking, private IP assignment, connection limits, randomized listening ports, and rapid connection tracking timeouts collectively render the port shadow attack extremely challenging to execute.
At TorGuard VPN, we are committed to continuously improving and testing our security infrastructure. We have actively engaged with researchers to validate our defenses and ensure that our users remain protected against emerging threats. The recent attempt to create a PoC for the port shadow attack on our network was unsuccessful, reaffirming our security measures.