{"id":114374,"date":"2024-03-17T12:25:42","date_gmt":"2024-03-17T10:25:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opredelenie-seansov-openvpn-v-tranzitnom-trafike"},"modified":"2024-03-17T12:25:42","modified_gmt":"2024-03-17T10:25:44","slug":"opredelenie-seansov-openvpn-v-tranzitnom-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","title":{"rendered":"Definition af OpenVPN-sessioner i transittrafikken.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra Michigan State University har offentliggjort resultaterne af en unders\u00f8gelse om muligheden for identifikation (VPN Fingerprinting) af forbindelser til servere baseret p\u00e5 OpenVPN ved overv\u00e5gning af transittrafik. Det blev identificeret tre metoder til at genkende OpenVPN-protokollen blandt andre netv\u00e6rkspakker, som kan anvendes i trafikinspektionssystemer til at blokere virtuelle netv\u00e6rk baseret p\u00e5 OpenVPN. <\/p>\n

Testningen av de f\u00f6reslagna metoderna i internetleverant\u00f6ren Merit, som har mer \u00e4n en miljon anv\u00e4ndare, visade att 85 % av OpenVPN-sessionerna kunde identifieras med en l\u00e5g grad av falska positiva. F\u00f6r att kontrollera detta f\u00f6rbereddes ett verktyg som f\u00f6rst i passivt l\u00e4ge i realtid kunde identifiera OpenVPN-trafik och sedan bekr\u00e4fta resultatets korrekthet genom aktiv kontroll av servern. P\u00e5 den analysator som forskarna skapade speglades trafikfl\u00f6det med en intensitet p\u00e5 cirka 20 Gbps.

\"Definition<\/center> <\/p>\n

I l\u00f8bet af eksperimentet form\u00e5ede analysatoren at identificere 1718 ud af 2000 testede OpenVPN-forbindelser, der blev oprettet af en falsk klient, hvor der blev brugt 40 forskellige typer af OpenVPN-konfigurationer (metoden fungerede vellykket for 39 ud af 40 konfigurationer). Desuden blev der i l\u00f8bet af otte dages eksperimentering i transittrafikken identificeret 3638 OpenVPN-sessioner, hvoraf 3245 blev bekr\u00e6ftet. Det bem\u00e6rkes, at det \u00f8verste niveau af falske positiver i den foresl\u00e5ede metode er tre st\u00f8rrelsesordener lavere end de tidligere foresl\u00e5ede metoder baseret p\u00e5 anvendelse af maskinl\u00e6ring. <\/p>\n

Separat utv\u00e4rderades effekten av metoderna f\u00f6r skydd mot sp\u00e5rning av OpenVPN-trafik i kommersiella tj\u00e4nster \u2013 av de 41 som testades. VPN<\/a>-tjenester, der anvendte metoder til at skjule OpenVPN-trafik, lykkedes det at identificere trafikken i 34 tilf\u00e6lde. De tjenester, der ikke kunne opdages, benyttede, udover OpenVPN, ekstra lag til at skjule trafikken (for eksempel ved at videregive OpenVPN-trafik gennem en ekstra krypteret tunnel). I de fleste af de succesfuldt identificerede tjenester blev der anvendt forvr\u00e6ngning af trafikken ved hj\u00e6lp af XOR-operation, ekstra obfuskationslag uden tilstr\u00e6kkelig tilf\u00e6ldig tilf\u00f8jelse af trafik eller tilstedev\u00e6relsen af uobfuskede OpenVPN-tjenester p\u00e5 samme serveren<\/a>. <\/p>\n

De anv\u00e4nda identifieringsmetoderna baseras p\u00e5 kopplingen till specifika f\u00f6r OpenVPN-m\u00f6nster i okrypterade pakethuvuden, storleken p\u00e5 ACK-paket och serverns svar. I det f\u00f6rsta fallet kan kopplingen till f\u00e4ltet \u00abopcode\u00bb i paketets huvud anv\u00e4ndas som objekt f\u00f6r identifiering i samband med anslutningens f\u00f6rhandlingsskede, vilket har ett fast intervall av v\u00e4rden och \u00e4ndras p\u00e5 ett specifikt s\u00e4tt beroende p\u00e5 anslutningens etableringssteg. Identifieringen inneb\u00e4r att \u00e5terfinna en specifik sekvens av opcode-f\u00f6r\u00e4ndringar i de f\u00f6rsta N-paketen av fl\u00f6det. <\/p>\n

Den anden metode er baseret p\u00e5, at ACK-pakker i OpenVPN kun anvendes i forhandlingsstadiet af forbindelsen og dermed har en specifik st\u00f8rrelse. Identifikation er baseret p\u00e5, at ACK-pakker i den angivne st\u00f8rrelse kun findes i bestemte dele af sessionen (for eksempel er den f\u00f8rste ACK-pakke normalt den tredje pakke med data sendt i sessionen, n\u00e5r man bruger OpenVPN).

\"Definition<\/center> <\/p>\n

Den tredje metoden \u00e4r aktiv kontroll och beror p\u00e5 att OpenVPN-servern skickar ett specifikt RST-paket som svar p\u00e5 en beg\u00e4ran om att \u00e5terst\u00e4lla anslutningen (kontrollen fungerar inte n\u00e4r l\u00e4get \u00abtls-auth\u00bb anv\u00e4nds eftersom OpenVPN-servern ignorerar beg\u00e4rningar fr\u00e5n klienter som inte \u00e4r autentiserade via TLS).

\"Definition<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0442\u0440\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OpenVPN \u0441\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN. \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432 \u0441\u0435\u0442\u0438 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114375,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Identifikation af OpenVPN-sessioner i transittrafik | ProHoster","description":"En gruppe forskere fra University of Michigan har offentliggjort resultaterne fra en unders\u00f8gelse om muligheden for at identifikation (VPN Fingerprinting) af forbindelser til servere baseret p\u00e5 OpenVPN ved overv\u00e5gning af transittrafik.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 OpenVPN \u0432 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-17T10:25:44+00:00","article:modified_time":"2024-03-17T10:25:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114374","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-04 14:42:04","updated":"2026-02-09 21:37:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=114374"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114374\/revisions"}],"predecessor-version":[{"id":159861,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/114374\/revisions\/159861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/114375"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=114374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=114374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=114374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}