{"id":114374,"date":"2024-03-17T12:25:42","date_gmt":"2024-03-17T10:25:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opredelenie-seansov-openvpn-v-tranzitnom-trafike"},"modified":"2024-03-17T12:25:42","modified_gmt":"2024-03-17T10:25:44","slug":"opredelenie-seansov-openvpn-v-tranzitnom-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","title":{"rendered":"Definirea sesiunilor OpenVPN \u00een traficul de tranzit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la Universitatea Michigan a publicat rezultatele unei cercet\u0103ri privind posibilitatea identific\u0103rii (VPN Fingerprinting) conexiunilor la serverele bazate pe OpenVPN \u00een timpul monitoriz\u0103rii traficului de tranzit. \u00cen concluzie, au fost identificate trei metode de identificare a protocolului OpenVPN printre alte pachete de date, care pot fi utilizate \u00een sistemele de inspec\u021bie a traficului pentru blocarea re\u021belelor virtuale bazate pe OpenVPN. <\/p>\n

Testarea metodelor propuse \u00een re\u021beaua furnizorului de internet Merit, care are peste un milion de utilizatori, a ar\u0103tat posibilitatea identific\u0103rii a 85% din sesiunile OpenVPN cu un nivel sc\u0103zut de fals pozitive. Pentru verificare, a fost preg\u0103tit un instrumentar care, mai \u00eent\u00e2i \u00een modul pasiv, detecta \u00een timp real traficul OpenVPN, iar apoi se asigura de corectitudinea rezultatului printr-o verificare activ\u0103 a serverului. Traficul a fost redirec\u021bionat prin analizorul creat de cercet\u0103tori, cu o intensitate de aproximativ 20 Gbps.

\"Definirea<\/center> <\/p>\n

\u00cen cadrul experimentului, analizorul a reu\u0219it s\u0103 identifice cu succes 1718 din cele 2000 de conexiuni testate OpenVPN, stabilite de un client fictiv, care a folosit 40 de configura\u021bii tipice diferite OpenVPN (metoda a func\u021bionat cu succes pentru 39 din cele 40 de configura\u021bii). \u00cen plus, \u00een cele opt zile de desf\u0103\u0219urare a experimentului, \u00een traficul de tranzit au fost identificate 3638 de sesiuni OpenVPN, dintre care 3245 au fost confirmate. Se observ\u0103 c\u0103 pragul superior de fals pozitive \u00een metoda propus\u0103 este cu trei ordine de magnitudine mai mic dec\u00e2t \u00een metodele anterioare, bazate pe utilizarea \u00eenv\u0103\u021b\u0103rii automate. <\/p>\n

Separat, a fost evaluat\u0103 eficien\u021ba metodelor de protec\u021bie \u00eempotriva urm\u0103ririi traficului OpenVPN \u00een servicii comerciale \u2014 din 41 testate VPN<\/a>-servicii care au utilizat metode de ocultare a traficului OpenVPN, traficul a fost identificat \u00een 34 de cazuri. Serviciile care nu au putut fi detectate au folosit, pe l\u00e2ng\u0103 OpenVPN, straturi suplimentare pentru a ascunde traficul (de exemplu, prin tunelarea traficului OpenVPN printr-un tunel criptat suplimentar). \u00cen majoritatea serviciilor care au fost identificate cu succes, au fost utilizate distorsion\u0103ri ale traficului prin opera\u021bia XOR, straturi suplimentare de obfuscation f\u0103r\u0103 o ad\u0103ugare aleatorie adecvat\u0103 a traficului sau prezen\u021ba unor servicii OpenVPN neobfuscate pe acela\u0219i server<\/a>. <\/p>\n

Metodele utilizate pentru identificare se bazeaz\u0103 pe corelarea cu modele specifice OpenVPN \u00een antetele necriptate ale pachetelor, dimensiunea pachetelor ACK \u0219i r\u0103spunsurile serverului. \u00cen primul caz, ca obiect pentru identificare, \u00een stadiul de negociere a conexiunii poate fi utilizat\u0103 corelarea cu c\u00e2mpul \u201eopcode\u201d din antetul pachetelor, care accept\u0103 o gam\u0103 fix\u0103 de valori \u0219i se schimb\u0103 \u00eentr-un mod specific \u00een func\u021bie de etapa stabilirii conexiunii. Identificarea se rezum\u0103 la identificarea unei secven\u021be specifice de schimb\u0103ri ale opcode-ului \u00een primele N pachete ale fluxului. <\/p>\n

Al doilea mod se bazeaz\u0103 pe faptul c\u0103 pachetele ACK sunt utilizate \u00een OpenVPN doar \u00een etapa de negociere a conexiunii \u0219i au o dimensiune specific\u0103. Identificarea se bazeaz\u0103 pe faptul c\u0103 pachetele ACK de dimensiune dat\u0103 apar doar \u00een anumite p\u0103r\u021bi ale sesiunii (de exemplu, \u00een utilizarea OpenVPN, primul pachet ACK este de obicei al treilea pachet cu date transmise \u00een sesiune).

\"Definirea<\/center> <\/p>\n

A treia metod\u0103 este o verificare activ\u0103 \u0219i se bazeaz\u0103 pe faptul c\u0103, ca r\u0103spuns la o solicitare de resetare a conexiunii, serverul OpenVPN trimite un pachet RST specific (verificarea nu func\u021bioneaz\u0103 \u00een modul \u201etls-auth\u201d, deoarece serverul OpenVPN ignor\u0103 solicit\u0103rile de la clien\u021bii care nu sunt autentifica\u021bi prin TLS).

\"Definirea<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0442\u0440\u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 OpenVPN \u0441\u0440\u0435\u0434\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0438\u043d\u0441\u043f\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN. \u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432 \u0441\u0435\u0442\u0438 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114375,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Identificarea sesiunilor OpenVPN \u00een traficul de tranzit | ProHoster","description":"Un grup de cercet\u0103tori de la Universitatea din Michigan a publicat rezultatele unei cercet\u0103ri privind posibila identificare (VPN Fingerprinting) a conexiunilor c\u0103tre servere bazate pe OpenVPN prin monitorizarea traficului de tranzit.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 OpenVPN \u0432 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041c\u0438\u0447\u0438\u0433\u0430\u043d\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (VPN Fingerprinting) \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 OpenVPN \u043f\u0440\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/opredelenie-seansov-openvpn-v-tranzitnom-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-17T10:25:44+00:00","article:modified_time":"2024-03-17T10:25:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114374","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-04 14:42:04","updated":"2026-02-09 21:37:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114374"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114374\/revisions"}],"predecessor-version":[{"id":159861,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114374\/revisions\/159861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/114375"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}