{"id":114374,"date":"2024-03-17T12:25:42","date_gmt":"2024-03-17T10:25:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opredelenie-seansov-openvpn-v-tranzitnom-trafike"},"modified":"2024-03-17T12:25:42","modified_gmt":"2024-03-17T10:25:44","slug":"opredelenie-seansov-openvpn-v-tranzitnom-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","title":{"rendered":"Definice OpenVPN sezen\u00ed v tranzitn\u00edm provozu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdzkumn\u00edk\u016f z Michigansk\u00e9 univerzity zve\u0159ejnila v\u00fdsledky v\u00fdzkumu mo\u017enosti identifikace (VPN Fingerprinting) spojen\u00ed k server\u016fm na b\u00e1zi OpenVPN p\u0159i monitorov\u00e1n\u00ed tranzitn\u00edho provozu. Byly odhaleny t\u0159i zp\u016fsoby identifikace protokolu OpenVPN mezi ostatn\u00edmi s\u00ed\u0165ov\u00fdmi pakety, kter\u00e9 mohou b\u00fdt pou\u017eity v syst\u00e9mech inspekce provozu k blokov\u00e1n\u00ed virtu\u00e1ln\u00edch s\u00edt\u00ed na b\u00e1zi OpenVPN. <\/p>\n

Testov\u00e1n\u00ed navr\u017een\u00fdch metod v s\u00edti internetov\u00e9ho poskytovatele Merit, kter\u00fd m\u00e1 v\u00edce ne\u017e milion u\u017eivatel\u016f, uk\u00e1zalo, \u017ee je mo\u017en\u00e9 identifikovat 85 % sezen\u00ed OpenVPN s minim\u00e1ln\u00ed \u00farovn\u00ed fale\u0161n\u00fdch pozitiv. Pro ov\u011b\u0159en\u00ed byl p\u0159ipraven n\u00e1stroj, kter\u00fd nejprve v pasivn\u00edm re\u017eimu on-the-fly ur\u010doval OpenVPN provoz a pot\u00e9 ov\u011b\u0159oval spr\u00e1vnost v\u00fdsledku prost\u0159ednictv\u00edm aktivn\u00ed kontroly serveru. Na anal\u00fdz\u00e1tor vytvo\u0159en\u00fd v\u00fdzkumn\u00edky byl zrcadlen provoz o intenzit\u011b p\u0159ibli\u017en\u011b 20 Gbps.

\"Definice<\/center> <\/p>\n

B\u011bhem experimentu dok\u00e1zal analytik \u00fasp\u011b\u0161n\u011b ur\u010dit 1718 z 2000 testovac\u00edch OpenVPN spojen\u00ed, kter\u00e1 byla nastavena na zku\u0161ebn\u00edm klientovi, na kter\u00e9m bylo pou\u017eito 40 r\u016fzn\u00fdch typov\u00fdch konfigurac\u00ed OpenVPN (metoda \u00fasp\u011b\u0161n\u011b fungovala pro 39 z 40 konfigurac\u00ed). Krom\u011b toho bylo b\u011bhem osmi dn\u00ed trv\u00e1n\u00ed experimentu v tranzitn\u00edm provozu odhaleno 3638 sezen\u00ed OpenVPN, z nich\u017e bylo potvrzeno 3245 sezen\u00ed. Uv\u00e1d\u00ed se, \u017ee horn\u00ed mez fale\u0161n\u00fdch pozitiv v navrhovan\u00e9 metod\u011b je t\u0159ikr\u00e1t ni\u017e\u0161\u00ed ne\u017e v d\u0159\u00edve navrhovan\u00fdch metod\u00e1ch zalo\u017een\u00fdch na pou\u017eit\u00ed strojov\u00e9ho u\u010den\u00ed. <\/p>\n

Samostatn\u011b byla hodnocena \u00fa\u010dinnost metod ochrany proti sledov\u00e1n\u00ed OpenVPN provozu v komer\u010dn\u00edch slu\u017eb\u00e1ch \u2014 z 41 testovan\u00fdch. VPN<\/a>-slu\u017eeb, kter\u00e9 pou\u017e\u00edvaly metody skr\u00fdv\u00e1n\u00ed provozu OpenVPN, bylo mo\u017en\u00e9 provoz identifikovat ve 34 p\u0159\u00edpadech. Slu\u017eby, kter\u00e9 nebyly odhaleny, krom\u011b OpenVPN pou\u017e\u00edvaly dal\u0161\u00ed vrstvy pro skr\u00fdv\u00e1n\u00ed provozu (nap\u0159. pos\u00edl\u00e1n\u00ed OpenVPN provozu p\u0159es dal\u0161\u00ed \u0161ifrovan\u00fd tunel). Ve v\u011bt\u0161in\u011b \u00fasp\u011b\u0161n\u011b identifikovan\u00fdch slu\u017eeb byla pou\u017eita deforma\u010dn\u00ed technika provozu pomoc\u00ed operace XOR, dodate\u010dn\u00e9 vrstvy obfuskov\u00e1n\u00ed bez dostate\u010dn\u00e9ho n\u00e1hodn\u00e9ho dopln\u011bn\u00ed provozu \u010di p\u0159\u00edtomnost neobfuskovan\u00fdch OpenVPN slu\u017eeb na stejn\u00e9m serveru<\/a>. <\/p>\n

Pou\u017eit\u00e9 metody identifikace se zakl\u00e1daj\u00ed na vazb\u011b na specifick\u00e9 pro OpenVPN vzory v neza\u0161ifrovan\u00fdch hlavi\u010dk\u00e1ch paket\u016f, velikosti ACK paket\u016f a odpov\u011bd\u00edch serveru. V prvn\u00edm p\u0159\u00edpad\u011b m\u016f\u017ee b\u00fdt objektem pro identifikaci ve f\u00e1zi dojedn\u00e1v\u00e1n\u00ed spojen\u00ed vazba na pole \"opcode\" v hlavi\u010dce paket\u016f, kter\u00e9 p\u0159eb\u00edr\u00e1 fixn\u00ed rozsah hodnot a ur\u010dit\u00fdm zp\u016fsobem se m\u011bn\u00ed v z\u00e1vislosti na f\u00e1zi navazov\u00e1n\u00ed spojen\u00ed. Identifikace spo\u010d\u00edv\u00e1 v ur\u010den\u00ed ur\u010dit\u00e9 posloupnosti zm\u011bny opcode v prvn\u00edch N paketech toku. <\/p>\n

Druh\u00e1 metoda se zakl\u00e1d\u00e1 na tom, \u017ee ACK-pakety se v OpenVPN pou\u017e\u00edvaj\u00ed pouze ve f\u00e1zi zaji\u0161t\u011bn\u00ed spojen\u00ed a p\u0159itom maj\u00ed specifickou velikost. Identifikace se zakl\u00e1d\u00e1 na tom, \u017ee ACK-pakety dan\u00e9 velikosti se vyskytuj\u00ed pouze v ur\u010dit\u00fdch \u010d\u00e1stech relace (nap\u0159\u00edklad p\u0159i pou\u017eit\u00ed OpenVPN je prvn\u00ed ACK-paket obvykle t\u0159et\u00edm paketem s daty odeslan\u00fdmi v relaci).

\"Definice<\/center> <\/p>\n

T\u0159et\u00ed metoda je aktivn\u00edm ov\u011b\u0159en\u00edm a je podm\u00edn\u011bna t\u00edm, \u017ee v reakci na po\u017eadavek na resetov\u00e1n\u00ed spojen\u00ed server OpenVPN ode\u0161le ur\u010dit\u00fd RST paket (ov\u011b\u0159en\u00ed nefunguje p\u0159i pou\u017eit\u00ed re\u017eimu \"tls-auth\", proto\u017ee OpenVPN server v n\u011bm ignoruje po\u017eadavky od klient\u016f, kte\u0159\u00ed nejsou ov\u011b\u0159eni prost\u0159ednictv\u00edm TLS).

\"Definice<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0442\u0440\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OpenVPN \u0441\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN. \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432 \u0441\u0435\u0442\u0438 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114375,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ur\u010den\u00ed relac\u00ed OpenVPN v tranzitn\u00edm provozu | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Michigansk\u00e9 univerzity zve\u0159ejnila v\u00fdsledky v\u00fdzkumu mo\u017enosti identifikace (VPN Fingerprinting) spojen\u00ed na servery zalo\u017een\u00e9 na OpenVPN p\u0159i monitorov\u00e1n\u00ed tranzitn\u00edho provozu.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 OpenVPN \u0432 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-17T10:25:44+00:00","article:modified_time":"2024-03-17T10:25:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114374","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-04 14:42:04","updated":"2026-02-09 21:37:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=114374"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114374\/revisions"}],"predecessor-version":[{"id":159861,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114374\/revisions\/159861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/114375"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=114374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=114374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=114374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}