Thank you very much for having me and today I will be talking about protecting VPNs
against decloking. It's just a little bit background about myself, so currently I'm a manager
for development and quality engineering and the network management team at Red Hat. So
we are responsible for network manager and them state network system all in some related
projects. Before that I was a software engineer, basically working in the team and even
before that I was actually a penetration test. So therefore like I have the history of
breaking software and I have to fix it. This is quite useful to understand what security
issues. I understand the security perspective and the developers perspective as well.
So today as I said we will be talking about VPN decloking, decloking how to prevent
this. So this is something a term that was coined by the VATons security with the
CVE last year called Carnivision and the idea is that it's possible to manipulate
the system so that it sends a packet to an attack instead of the VPN. Anyone heard
of Carnivision before? Who has heard of this?
If you. Okay. So this is the type of the title of their blog post where they describe
that already gives some insights about the components that are required. So the title was
how attackers can decloking or watching based VPNs for a total VPN dec. And so what are
the key components that we will be talking about from tunnel vision perspective? So there's
ones. There's DHCP dynamic cross configuration protocol. We doesn't know what this is. Perfect.
Makes me save some time and so this is there to create the network to send the network
configuration to the house and watching both VPNs. So who knows what's watching based
VPN? Like what's the specific about watching based? A few. So that's good then because
I will explain it. So in general like VPN is there. So you can connect to remote network
from locally and there you. So you want your packets that you send locally to end up in
the remote network and there's like the different techniques like one. For example that we
want. Look into this IPSEC policy mode where you just encrypt the packet itself and then
you can send it everywhere or what you're looking here as a watching based VPNs and there
you have a watching tab on this system that defines that that graduates send the packets.
Quickly mind about watching tablets. So this is like a very minimum example. It says like
at the beginning or packets should be sent to the gateway that's ending in 23. So this one.
So you can like reach the internet or any other house that's not local and to reach local
like house locally to you. You have the other wall that just says like all IP addresses
here you can reach on this device directly. And then like if you use a VPN, watching
based VPN. So here at the top you see the old configuration that we are and now that we have
two more walls like that in this case we use the whole 10 slash eight IP address space for
the VPN. So in the internet work is this one and we reach this wire gateway inside the
virtual private network and to reach this gateway and the other house could we have a second
route. And what this makes this security relevant configuration because that's basically
the policy to be encrypted packet to be not encrypted packet. So therefore it should be protected.
The problem is or the problem that deviate and security raised with tunnel version is that
DHCP that we talked about that that's local configuration system supports changing the
routing table. There's this option 121 classed stage word option and this means the DHCP server
can tell the system to use words like this. And the thing is I forgot to mention this before.
So let's. So we have like this routing table how do you use this? It means like by default
it goes there but how does this system to decide when to use this word instead? And that's the
prefix thing you know here by 24. So the most specific the word is that word wins in the end.
So I mean this so what what we have here we have at the top is see fs-8 vpn network and here we have
a lot more specific words from the attacker and instead of using the vpn device tan 0 which means
it's protected. We use the wireless device. It's like whenever the house tries to reach
my peer address from the system the packets will be sent unencrypted locally. Any questions
about this so far? Perfect. So this like originally this was reported
so when a vulnerability in DHCP and what's your opinion is it one?
So like it's property of the yeah the configuration of the vpn yeah I agree it's a good response
yes so that if you look at the cvd page it currently says like the problem is from the vendor
IETF and the product DHCP so so I will mention this later again because also fast like the
maintainer or developers of network manager the good thing that it was reported as this was
that it actually ended on our heads because we implemented DHCP with network manager or on
internal clients so we became aware of this and then yeah one team member started looking into this
in considering like some fixes so what do we do about this? Like there are some nodes in the
description that said for example Android is not affected by tunnel vision because they do not
support DHCP option one to one. So first thought is okay let's add an option to network manager
that we can ignore this option as well so you just can configure this system so it doesn't break anymore.
So we talked about this and like we did not really come to an agreement does this make sense?
Is it the right solution? Is it not? There are some other options in software that you can use
that are going to that network namespaces for example that allows to do some separation
that's more than what we what I will describe later here but it's a lot more complicated to implement
and network manager does not have support for network namespaces yet so it means it's a really
big undertaking to change this directly network manager and so only that so currently we only had
this solution ignore the DHCP option but then so I said no I'm a manager I'm not a developer
anymore so I checked on this and then I said okay now that's to our point into annoying so
I said then you go for the team this needs to be done differently because for example you need to
like with this solution you would have to change like whenever you have a configuration for DHCP
to ignore this option even the weather note you have VPN already configured because you might
edit later so like my goal as manager was now we need to make it possible for the users to
change the VPN configuration instead of the DHCP configuration but then with this solution again
it becomes complicated because you're now affecting from the VPN configuration that is to peak configuration
so the interface becomes really odd that we want to change this for all the
like interface or not then need to configure in the VPN configuration only for this interface
but not for this so still to complicated and then luckily the the one of my teammates in
you go it sits right over there so yeah it's a great idea that we're going to use
policy routing do you know what's policy routing who doesn't okay so that's expanded
so first I said like they are routing tables that is that's head of the decisions where to put
packets but that's not the whole two there's actually more than one routing table you know
actually I wanted to check it like how many there could be maybe 32,000 maybe six probably
something about 64,000 looking at this number and the one routing table that we looked to far
was the main routing table so here in this policy let's look at the priority well I would
rather like originally it's called priority but smaller like a look up order because like those
number it's not the highest priority those numbers looked up first then we have some kind of policies
for example in this case very simple from all so just effects everything and then look up
the routing table and the one that we looked at so far was the main routing table
and the idea to prevent that to change this to mitigate the tunnel vision attack is to introduce
another routing table in this case you see it here it's called VPN and it has a priority value that
makes it looked up before the main table and then you can add the routes that are meant for the VPN
policy so like the whole network 10 slash 8 in this table and then it will be looked up first so
like whatever options DHCP puts into the main what DHCP puts into the main table doesn't
matter anymore because the VPN table will take care of this but then like we're in a security
platform so what do you need in a security presentation you need some zero days what do you think so
so the good thing like the method already prevents against other attacks and so on so kind of like
the zero days will already be mitigated by this and then like when we looked at this for like initially
like we also start okay DHCP is insecure you can configure things why is it even a security
vulnerability then we thought about some other attack vectors for example what if the local
network is already it has the same IP address range at the VPN so then you don't need the DHCP
option one to one because they're all good already be the same and like some other similar attacks
and then we found out there is actually this was actually reported
a year before tunnel vision as well like there are some related attacks
around this so that's called tunnel track and they split it in local net and server IP
attacks that they're mostly targeting DHCP as well but also DNS because that if you think about it
DHCP can come it's an untrusted protocol that can change something DNS at the same time
is also not really very dated and if you have if you configure your VPN end point using a
house name then like if the attacker controls the local network they can also change the
reported IP address then again you can use this information to have too many played the
watching table okay so maybe no zero days but that's not true because
like we have in my team I really have very qualified engineers and another one the one who
initially looked at this
at this problem because we implemented it we did not only break it and in fact there are two more
DHCP options where it can configure about so that like we only talk about one to one but there's
also like the older one option 33 it's not as powerful as the other one because we can only
configure this based on the historical classes of networks so that they're class ABC networks
depending on the prefix thing but if you think about like some attack scenarios like where you
want to just tunnel everything to your VPN so you just have the default wood then it's specific
test ABC what is still more specific than the default wood so you still have similar attack
vectors in this case and then Microsoft also has their own option as well that like we
are getting support so we also knew about this so should this be two more zero days thank you
we have also I don't know tunnel with and tunnel drift or something and there's even another zero day
I just call it zero day for fun but I don't really think it's another vulnerability because
like they were already sub-NCVs around the different aspects and like this is a topic
this is something that has been often a topic at first and as well so I was wondering
if anyone has a guess what it could be if you think about what we saw so far
I wonder what happens if the local IP address in the network the entrusted network
you're connecting to classes with the one you want to connect to yeah yeah I think that that's
basically the local net like it's I would call it like a variant of the local net at
fact because it assumes that you use the same local network as the VPN but if just the gateway is the
same so you have like at least one house that could be the same the VPN anything like what
innovation did be up in the network it forced them yeah IPv6 exactly so like all the examples
let me saw only IPv4 and in what's the IPv6 so like there's also DHCPv6 but it doesn't
support walls so is it safe or not no it's not because there's the status address out of
configuration so water by default like everyone who supports IPv6 will accept routes that are
announced by the water as well so in the end you you can do the same attack that's where but
is this really big problem luckily not because Linux spots these wild policies
modern type adjusts the same with IPv6 to the IPv4 so same solution you just need to remember
that's also IPv6 coming or at first unless already there so what does it look like with net
back manager currently so it's like the command line to it so there you can modify VPN
connections and then specify about table so network manager doesn't support names for
WhatsApp on the IDs because the name to ID mapping is something that's in user space that's
not like an official API of the kernel so network manager cannot really rely on this and
yeah do this for IPv4 IPv6 and then you can easily set things up and this seems to be like the
first practical device how you can actually do this because like if you look at what should I do
there's this there are a lot of theories like user different or I mean like the first solution is
don't use DHCP okay and you add the hotel so you can choose this then you can use you can bring
a second water so that also separates the entrusted network from the network that you want to use
still you need additional hardware next thing you use a virtual machine basically the same thing
but log on your machine for a little bit unconventional because now you have to work
the virtual machine instead of your analysis and then kind of getting closer now we have
the routing table which is just under system helps there mostly as well so sorry I forgot but
then like the next abstraction is the network name spaces so it's also kind of a separation
another layer on top of the routing tables we can have different routing tables for different
processes or different containers which basically name space still a little bit more complicated to
set up but now like we have this even easier solution it's just the routing table and you have
like a generic solution both network manager we can just configure this for UVPN and it works
more or less for UVPN plugins directly because network manager gets the route set up moves them to the
right table so what should be the takeaways from this presentation so if you use water VPNs this
means you're watching table becomes part of the VPN configuration so it's now security relevant
setting if you think about security and so security users don't let DHCP and other protocols like
SLag is the IPv6 configuration protocol or DNS which is also on on protocol change the VPN configuration
and if it's going to be accepted there will be a presentation about improving
configuring encrypted DNS with network manager as a lighting truck I think there will be
tomorrow so if you want to follow up on this there's something and the other thing is about CVEs there's
also problem with the reporting how you do this for this kind of vulnerabilities because like the
CVEs might be too specific for example like the television just set you have option 1 to 1 it's problem
okay I don't support option 1 to 1 now I'm safe but the concept of the problem is that you use
that you have this untrusted protocol that now can configure your trusted settings because
that what happens if I mean the option 1 to 1 exists for a reason because some people need this
so eventually it could be added to the DHCP client as well also then another thing for example
like what we did notice tunnel crack the order vulnerability or reported vulnerabilities about this
was because they mentioned only specific VPN providers instead of making it a global like a generic
conceptual problem so in man care I'm not using I don't know whatever VPN software there was
so I'm safe again it's not really clear what to use and then yeah at the same time
there is also two words like when you have like tunnel vision originally ietf as the window
DHCP as the protocol but I know it works as specified as the problem and then so there's the
outlook unfortunately there's there's some attack vectors in the configuration network so it's
complicated to get this right I will follow up on this at some other point because we are in the
auto time then for network manager we have to think about that I currently it's still a
configuration option that you need to set but should this be the default or not so that's again
like with this big other things where you're not so if anyone of you has any ideas about this we
also have a network manager community meet up in the few hours and yeah document this thank you very much
natural do we have time for questions or not okay yes or no