{"id":114374,"date":"2024-03-17T12:25:42","date_gmt":"2024-03-17T10:25:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opredelenie-seansov-openvpn-v-tranzitnom-trafike"},"modified":"2024-03-17T12:25:42","modified_gmt":"2024-03-17T10:25:44","slug":"opredelenie-seansov-openvpn-v-tranzitnom-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","title":{"rendered":"Defini\u00e7\u00e3o de sess\u00f5es OpenVPN em tr\u00e1fego de tr\u00e2nsito","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um grupo de pesquisadores da Universidade de Michigan publicou os resultados de um estudo sobre a possibilidade de identifica\u00e7\u00e3o (VPN Fingerprinting) de conex\u00f5es a servidores baseados em OpenVPN ao monitorar o tr\u00e1fego de tr\u00e2nsito. No final, foram identificados tr\u00eas m\u00e9todos para identificar o protocolo OpenVPN entre outros pacotes de rede, que podem ser utilizados em sistemas de inspe\u00e7\u00e3o de tr\u00e1fego para bloquear redes virtuais baseadas em OpenVPN. <\/p>\n

Os testes dos m\u00e9todos propostos na rede do provedor de internet Merit, que possui mais de um milh\u00e3o de usu\u00e1rios, mostraram a possibilidade de identificar 85% das sess\u00f5es OpenVPN com um n\u00edvel insignificante de falsos positivos. Para a verifica\u00e7\u00e3o, foi preparado um conjunto de ferramentas que, inicialmente, detectava o tr\u00e1fego OpenVPN em modo passivo e, em seguida, confirmava a precis\u00e3o do resultado por meio de uma verifica\u00e7\u00e3o ativa do servidor. O analisador criado pelos pesquisadores foi espelhado com um fluxo de tr\u00e1fego de aproximadamente 20 Gbps.

\"Defini\u00e7\u00e3o<\/center> <\/p>\n

Durante o experimento, o analisador conseguiu identificar com sucesso 1718 de 2000 conex\u00f5es OpenVPN de teste estabelecidas por um cliente falso, utilizando 40 diferentes configura\u00e7\u00f5es padr\u00e3o do OpenVPN (o m\u00e9todo funcionou com sucesso para 39 das 40 configura\u00e7\u00f5es). Al\u00e9m disso, durante os oito dias do experimento, foram identificadas 3638 sess\u00f5es OpenVPN no tr\u00e1fego de tr\u00e2nsito, das quais 3245 foram confirmadas. Observa-se que o limite superior de falsos positivos no m\u00e9todo proposto \u00e9 tr\u00eas ordens de magnitude menor do que nos m\u00e9todos anteriormente sugeridos, que se baseavam em aprendizado de m\u00e1quina. <\/p>\n

Al\u00e9m disso, foi avaliado o desempenho dos m\u00e9todos de prote\u00e7\u00e3o contra o rastreamento do tr\u00e1fego OpenVPN em servi\u00e7os comerciais \u2014 de 41 testados. VPN<\/a>-o tr\u00e1fego conseguiu ser identificado em 34 casos. Os servi\u00e7os que n\u00e3o foram detectados, al\u00e9m do OpenVPN, utilizaram camadas adicionais para ocultar o tr\u00e1fego (por exemplo, passando o tr\u00e1fego OpenVPN por meio de um t\u00fanel criptografado extra). Na maioria dos servi\u00e7os que foram identificados com sucesso, foram utilizados m\u00e9todos de distor\u00e7\u00e3o de tr\u00e1fego por meio da opera\u00e7\u00e3o XOR, camadas adicionais de ofusca\u00e7\u00e3o sem a devida aleatoriedade do tr\u00e1fego ou a presen\u00e7a de servi\u00e7os OpenVPN n\u00e3o ofuscados na mesma. servidor<\/a>. <\/p>\n

Os m\u00e9todos de identifica\u00e7\u00e3o utilizados baseiam-se na liga\u00e7\u00e3o a padr\u00f5es espec\u00edficos do OpenVPN em cabe\u00e7alhos de pacotes n\u00e3o criptografados, no tamanho dos pacotes ACK e nas respostas do servidor. No primeiro caso, como objeto para identifica\u00e7\u00e3o na fase de estabelecimento da conex\u00e3o, pode-se usar a liga\u00e7\u00e3o ao campo \u00abopcode\u00bb no cabe\u00e7alho dos pacotes, que assume uma faixa fixa de valores e muda de forma espec\u00edfica dependendo da fase de configura\u00e7\u00e3o da conex\u00e3o. A identifica\u00e7\u00e3o consiste em detectar uma sequ\u00eancia espec\u00edfica de mudan\u00e7as no opcode nos primeiros N pacotes do fluxo. <\/p>\n

O segundo m\u00e9todo baseia-se no fato de que os pacotes ACK s\u00e3o utilizados no OpenVPN apenas na fase de negocia\u00e7\u00e3o da conex\u00e3o e, ao mesmo tempo, possuem um tamanho espec\u00edfico. A identifica\u00e7\u00e3o baseia-se no fato de que pacotes ACK de um determinado tamanho aparecem apenas em partes espec\u00edficas da sess\u00e3o (por exemplo, ao usar o OpenVPN, o primeiro pacote ACK geralmente \u00e9 o terceiro pacote com dados transmitidos na sess\u00e3o).

\"Defini\u00e7\u00e3o<\/center> <\/p>\n

O terceiro m\u00e9todo \u00e9 uma verifica\u00e7\u00e3o ativa e est\u00e1 relacionado ao fato de que, em resposta a um pedido de redefini\u00e7\u00e3o da conex\u00e3o, o servidor OpenVPN envia um determinado pacote RST (a verifica\u00e7\u00e3o n\u00e3o funciona ao usar o modo \u00abtls-auth\u00bb, pois o servidor OpenVPN ignora requisi\u00e7\u00f5es de clientes n\u00e3o autenticados via TLS).

\"Defini\u00e7\u00e3o<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0442\u0440\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OpenVPN \u0441\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN. \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432 \u0441\u0435\u0442\u0438 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114375,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Identifica\u00e7\u00e3o de sess\u00f5es OpenVPN no tr\u00e1fego de tr\u00e2nsito | ProHoster","description":"Um grupo de pesquisadores da Universidade de Michigan publicou os resultados de uma pesquisa sobre a possibilidade de identifica\u00e7\u00e3o (VPN Fingerprinting) de conex\u00f5es a servidores baseados em OpenVPN ao monitorar o tr\u00e1fego de tr\u00e2nsito.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 OpenVPN \u0432 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-17T10:25:44+00:00","article:modified_time":"2024-03-17T10:25:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114374","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-04 14:42:04","updated":"2026-02-09 21:37:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=114374"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114374\/revisions"}],"predecessor-version":[{"id":159861,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/114374\/revisions\/159861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/114375"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=114374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=114374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=114374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}