Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities exploited in VPN products used worldwide

ncsc.gov.uk

Post reply on HN
Print view View original

11–20 of 140 posts

Re: Vulnerabilities exploited in VPN products used worldwide

#11

Post by numbsafari »

tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

The problem is, in a lot of enterprise environments, you can’t rely on a tool that lists itself as non-production ready, and therefore doesn’t / won’t have CVE, etc.

Scroll to the bottom of the wireguard.com site. It’s right on the tin, so to speak.

I’m very excited for wireguard, but have some empathy for large enterprises on this one.

Re: Vulnerabilities exploited in VPN products used worldwide

#12

Post by GhettoMaestro »

tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

Lots of loose language in your post.

Show me a FIPS140-2 Wireguard implementation.

Re: Vulnerabilities exploited in VPN products used worldwide

#13

Post by jackcodes »

Havoc wrote: post #10

>These vulnerabilities are well documented in open source. Seeing this awkward use of "open source" a lot lately. Its almost as if people think "readable on the internet for free" equals open source.

It does mean that. Free software and open source mean different things.

Re: Vulnerabilities exploited in VPN products used worldwide

#14

Post by snagglegaggle »

numbsafari wrote: post #11
tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

The problem is, in a lot of enterprise environments, you can’t rely on a tool that lists itself as non-production ready, and therefore doesn’t / won’t have CVE, etc. Scroll to the bottom of the wireguard.com site. It’s right on the tin, so to speak. I’m very excited for wireguard, but have some empathy for large enterprises on this one.

Empathy for a self-inflicted problem? Why?

Re: Vulnerabilities exploited in VPN products used worldwide

#15

Post by mr_puzzled »

tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

What do you think about cloudflare's vpn offerings? 1.1.1.1 and cf access?

Re: Vulnerabilities exploited in VPN products used worldwide

#16

Post by tcd »

tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

Wireguard isn't even stable yet - it's not even been mainlined by the Kernel which is one of the main selling points that it will eventually be included.

It's alpha level software at this point and should not be relied upon or even trusted.

Re: Vulnerabilities exploited in VPN products used worldwide

#17

Post by throwaway2048 »

ihuman wrote: post #9
tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

Why do you prefer Wireguard over Openvpn?

Wireguard is an extremely simple protocol, basically as simple as it is possible for an encrypted VPN protocol to be.

OpenVPN uses TLS (in TCP mode) and a custom protocol based off of TLS in UDP mode, its design is vastly over complicated by the use of x.509 certificates, and in general is just kind of ugly and kludgy (and slow).

Re: Vulnerabilities exploited in VPN products used worldwide

#18

Post by LoveKebabble »

snagglegaggle wrote: post #14
numbsafari wrote: post #11

Earlier quoted context omitted.

The problem is, in a lot of enterprise environments, you can’t rely on a tool that lists itself as non-production ready, and therefore doesn’t / won’t have CVE, etc. Scroll to the bottom of the wireguard.com site. It’s right on the tin, so to speak. I’m very excited for wireguard, but have some empathy for large enterprises on this one.

Empathy for a self-inflicted problem? Why?

He just explained it.

To add on to his points, there are often times corporate policies (You can argue the legitimacy of them or not) that absolutely mandate that you cannot run beta/non-fully released software in production.

One of the last places I worked last ensured that all of our firewall's (and other appliances I'm assuming, they were not my areas though) were an update or two behind (assuming no security vulnerabilities were identified) to ensure stability.

Re: Vulnerabilities exploited in VPN products used worldwide

#19

Post by kachnuv_ocasek »

ihuman wrote: post #9
tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

Why do you prefer Wireguard over Openvpn?

There's also a formal proof of Wireguard's security (not that it means much in practice, but I find it extremely interesting): https://prosecco.gforge.inria.fr/personal/bblanche/publicati...

Re: Vulnerabilities exploited in VPN products used worldwide

#20

Post by SteveNuts »

snagglegaggle wrote: post #14
numbsafari wrote: post #11

Earlier quoted context omitted.

The problem is, in a lot of enterprise environments, you can’t rely on a tool that lists itself as non-production ready, and therefore doesn’t / won’t have CVE, etc. Scroll to the bottom of the wireguard.com site. It’s right on the tin, so to speak. I’m very excited for wireguard, but have some empathy for large enterprises on this one.

Empathy for a self-inflicted problem? Why?

Because they undergo audits that have arbitrary rules, sometimes making it harder or impossible for them to use tools like wireguard.
Post reply on HN