{"id":53634,"date":"2019-12-06T00:00:00","date_gmt":"2019-12-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli"},"modified":"2020-02-18T14:01:34","modified_gmt":"2020-02-18T11:01:34","slug":"uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","title":{"rendered":"A vulnerability that allows intercepting TCP connections established through VPN tunnels.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Published<\/a><\/noindex> An attack technique (CVE-2019-14899) that allows for the replacement, modification, or insertion of packets in TCP connections routed through VPN tunnels. This issue affects Linux, FreeBSD, OpenBSD, Android, macOS, iOS, and other Unix-like systems. Linux supports the rp_filter (reverse path filtering) mechanism for IPv4, enabling which in 'Strict' mode mitigates this problem. <\/p>\n

The method allows for packet substitution at the level of TCP connections passing through an encrypted tunnel, but does not allow for interference in connections that utilize additional encryption layers (e.g., TLS, HTTPS, SSH). The encryption algorithms used in the VPN do not matter, as forged packets arrive from the external interface and are processed by the kernel as packets from the VPN interface. The most likely target of the attack is intervention in unencrypted HTTP connections, but the manifestation of vulnerabilities in systems from other manufacturers is not excluded.<\/a><\/noindex> the use of the attack to manipulate DNS responses. <\/p>\n

Successful packet substitution has been demonstrated for tunnels created using OpenVPN, WireGuard, and IKEv2\/IPSec. Tor is not susceptible to this issue, as it uses SOCKS for traffic tunneling and binds to the loopback interface. For IPv4, the attack is possible if the rp_filter is set to 'Loose' (sysctl net.ipv4.conf.all.rp_filter = 2). Initially, most systems operated in 'Strict' mode, but starting with systemd 240<\/a><\/noindex>, released last December, the default operating mode was changed to 'Loose', and this change is reflected in the default settings of many Linux distributions.<\/p>\n

The rp_filter mechanism is conducted<\/a><\/noindex> to further verify packet paths to prevent source address spoofing. When set to 0, source address verification is not performed, and any packet can be redirected between network interfaces without restrictions. Mode 1, 'Strict', checks each incoming packet from outside against the routing table, and if the network interface through which the packet was received is not linked to the optimal delivery route for a response, the packet is discarded. Mode 2, 'Loose', relaxes the check to allow operation when using load balancers or asymmetric routing, where
\nthe response route may not go through the same network interface from which the incoming packet arrived.<\/p>\n

In 'Loose' mode, the incoming packet is checked against the routing table but is considered valid if the source address is reachable through any available network interface. The proposed attack relies on the fact that an attacker can send a packet with a spoofed source address that corresponds to the VPN interface, and despite this packet arriving in the system through an external network interface instead of through the VPN, in 'Loose' rp_filter mode, such a packet will not be discarded. <\/p>\n

To carry out the attack, the attacker must control the gateway through which the user accesses the network (for example, through a MITM attack, connecting the victim to a wireless access point controlled by the attacker or through router hacking<\/a><\/noindex>). By controlling the gateway used by the user to connect to the network, the attacker can send bogus packets that will be perceived in the context of the VPN network interface, but responses will be directed through the tunnel.<\/p>\n

By generating a stream of bogus packets with the VPN interface's IP address, attempts are made to influence the connection established by the client, but the effect of these packets can only be observed through passive analysis of the encrypted traffic associated with the tunnel operation. To conduct the attack, it is necessary to know the IP address assigned by the VPN server to the tunnel's network interface and to determine that there is currently an active connection through the tunnel to a specific host. <\/p>\n

To determine the IP of the virtual VPN network interface, SYN-ACK packets are sent to the victim's system, systematically scanning the entire range of virtual addresses (first, the addresses used by default in VPNs, for example, OpenVPN uses the subnet 10.8.0.0\/24). The existence of an address can be inferred based on the receipt of a response with the RST flag.<\/p>\n

In the same way, the connection to a specific site and the port number on the client side is determined \u2014 by iterating through the port numbers, a SYN packet is sent with the site's IP address as the source address and the virtual IP of the VPN as the destination address. The server port can be predicted (80 for HTTP), while the client-side port number can be calculated by enumeration, analyzing the change in ACK-response intensity for different numbers in conjunction with the absence of packets with the RST flag.<\/p>\n

At this stage, the attacker knows all four elements of the connection (source IP address\/port and destination IP address\/port), but in order to generate a spoofed packet that the victim's system will perceive, the attacker must determine the sequence and acknowledgment numbers (seq and ack) of the TCP connection. To identify these parameters, the attacker continuously sends fake RST packets, iterating through different sequence numbers until an ACK packet response is recorded, indicating that the number falls within the TCP window. <\/p>\n

Next, the attacker verifies the correctness by sending packets with the same number and observing the incoming ACK responses, after which the exact current sequence number is determined. The task is complicated by the fact that responses are sent within an encrypted tunnel, and their presence in the intercepted traffic stream can only be analyzed indirectly. The fact that an ACK packet addressed to the VPN server is sent by the client is determined based on the size and delay of the encrypted responses, which correlate with the sending of spoofed packets. For example, for OpenVPN, an encrypted packet of size 79 reliably indicates that it contains an ACK acknowledgment.<\/p>\n

Before attack protection is added to the operating system kernel, as a temporary method to block the problem, it is recommended<\/a><\/noindex> using a packet filter in the 'preroute' chain to block packets that have a virtual tunnel IP address as their destination.<\/p>\n

iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP<\/p>\n

or for nftables<\/p>\n

nft add table ip raw
\n nft add chain ip raw prerouting '{ type filter hook prerouting priority 0; }'
\n nft add rule ip raw prerouting 'iifname != \"wg0\" ip daddr 10.182.12.8 fib saddr type != local drop'<\/p>\n

To ensure protection when using tunnels with IPv4 addresses, it is sufficient to set rp_filter to 'Strict' ('sysctl net.ipv4.conf.all.rp_filter = 1'). On the VPN side, the method for determining the sequence number can be blocked by adding padding to the encrypted packets, making all packet sizes identical. <\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043f\u0440\u043e\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Linux, FreeBSD, OpenBSD, Android, macOS, iOS \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 Unix-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. Linux \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c rp_filter (reverse path filtering) \u0434\u043b\u044f IPv4, \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u0436\u0438\u043c «Strict» \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u041c\u0435\u0442\u043e\u0434 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53634","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A vulnerability that allows intrusion into TCP connections established through VPN tunnels | ProHoster","description":"An attack technique (CVE-2019-14899) has been published that allows for the modification, alteration, or substitution of packets.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043a\u043b\u0438\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 TCP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 (CVE-2019-14899), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0432.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-vklinivatsya-v-tcp-soedineniya-osushhestvlyaemye-cherez-vpn-tunneli","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53634","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:21:20","updated":"2026-01-24 08:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/53634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=53634"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/53634\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=53634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=53634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=53634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}