A group of researchers from the University of Michigan published the results of a study on the capability to identify (VPN Fingerprinting) connections to servers based on OpenVPN while monitoring transit traffic. The study identified three methods of recognizing the OpenVPN protocol among other network packets, which could be used in traffic inspection systems to block virtual networks based on OpenVPN.
Testing the proposed methods on the network of the Merit Internet provider, which has over a million users, showed that 85% of OpenVPN sessions could be identified with a low level of false positives. To verify this, a toolkit was prepared that initially passively detected OpenVPN traffic in real-time and then confirmed the accuracy of the results through active checks of the server. The analyzer created by the researchers reflected a traffic stream with an intensity of approximately 20 Gbps.
During the experiment, the analyzer successfully identified 1718 out of 2000 test OpenVPN connections established by a fake client, utilizing 40 different standard OpenVPN configurations (the method worked successfully for 39 out of 40 configurations). Furthermore, during the eight days of the experiment, 3638 OpenVPN sessions were identified in transit traffic, of which 3245 sessions were confirmed. It is noted that the upper bound of false positives in the proposed method is three orders of magnitude lower than in previously suggested methods based on machine learning.
The performance of traffic tracking protection methods for OpenVPN in commercial services was assessed separately—out of 41 tested services utilizing OpenVPN traffic obfuscation methods, traffic was identifiable in 34 cases. The services that could not be detected used additional layers to conceal traffic besides OpenVPN (for instance, by tunneling OpenVPN traffic through an additional encrypted tunnel). In most successfully identified services, traffic distortion was deployed using the XOR operation, additional layers of obfuscation without sufficient random padding of traffic, or the presence of unobfuscated OpenVPN services on the same. VPN-service using traffic hiding methods of OpenVPN, the traffic was identified in 34 cases. Services that could not be detected, in addition to OpenVPN, used additional layers to hide the traffic (for example, tunneling OpenVPN traffic through an additional encrypted tunnel). In most successfully identified services, traffic distortion was used through XOR operation, additional layers of obfuscation without proper random traffic padding, or the presence of unobfuscated OpenVPN services on the same server.
The identification methods rely on specific OpenVPN patterns in unencrypted packet headers, the size of ACK packets, and server responses. In the first case, the binding to the 'opcode' field in the packet header, which takes a fixed range of values and changes in a certain way depending on the stage of establishing the connection, can be used as an identification object during the connection handshake phase. Identification is focused on detecting a specific sequence of opcode changes in the first N packets of the stream.
The second method is based on the fact that ACK packets in OpenVPN are only used during the connection handshake and have a specific size. Identification relies on the observation that ACK packets of a given size occur only in specific parts of the session (for example, when using OpenVPN, the first ACK packet is usually the third packet with data transmitted in the session).
The third method involves active verification and is based on the fact that in response to a connection reset request, the OpenVPN server sends a specific RST packet (this check does not work when using the 'tls-auth' mode, as the OpenVPN server ignores requests from clients not authenticated through TLS).
Source: opennet.ru
