Live data from Hacker News

Vulnerabilities exploited in VPN products used worldwide

ncsc.gov.uk

51–60 of 140 posts

Re: Vulnerabilities exploited in VPN products used worldwide

#51
post #49
post #41

Earlier quoted context omitted.

> It very explicitly doesn't want to deal with integrating with key management/HSMs/AD policies/whatever. If you look at the list of vulnerabilities, they're all precisely in those parts of the stack that Wireguard doesn't address. So what value is Wireguard providing, exactly? It's a beautiful protocol, but security isn't a beauty contest. It's easy to create a beautiful solution when you avoid dealing with the diff…

> If you look at the list of vulnerabilities If you look at THIS list of vulnerabilities, sure. That's not an exhaustive list of every problem standard VPNs have had though, you understand that right? > So what value is Wireguard providing, exactly? Even ignoring vulnerabilities entirely, OpenVPN and the like are full of footguns and are very, very easy to fuck yourself with. You talk about the value of practicality…

I'm not defending SSL-based VPN servers. They exist because people didn't understand how IPSec IKE worked or want to put in the effort to make it work better, and as is typical in the industry worse-is-better won the day.

But the value those SSL-based and similar bespoke VPN servers brought was automated key management, end-user based authentication, route setup, etc. They've done so horribly in terms of correctness and security, but nonetheless in a way that companies value.

Yes, Wireguard avoids all the pitfalls of the transport security. But so do the crappy SSL-based solutions, because they also have the benefit of hindsight.

What's the practical value of Wireguard over IPSec? AFAICT, it has marginally better NAT traversal; IPSec requires NAT-T (a UDP wrapper) which is marginally more complex. But what's the biggest impediment to IPSec uptake? It's IKE, which is a purely userland service. Most IKE implementations suck. Whatever solutions will be built around Wireguard, they'll ultimately look almost exactly like IKE in terms of their relationship to the in-kernel component--a userland daemon for PKI and/or general user authentication management which does some setup like installing the secret transport key and policy of the otherwise simple in-kernel components. But if those better IKE solutions don't exist (outside of OpenBSD), why would Wireguard magically make them appear?

At best what we'll get (what we are getting, as manifest in every VPN service and open source project announcement) with Wireguard is a recapitulation of the mess we have with SSL VPN products. All the same security issues revolving around horrible key management and poorly written software, all the same incompatibilities and vendor lock in stemming from the diverse "solutions". Except we'll have a beautiful transport layer protocol to soothe ourselves with.

I don't mean to criticize Wireguard. From a low-level engineering perspective it's beyond reproach. My concern is with how it's being received and the fantasies people have about how it will change things. And IMO (which I admit is my opinion--not a hill I'd choose to die on, but something I'd still wager on and orient my plans around) is that long-term security would be better spent by fixing (mostly deprecating old modes) and reinforcing IPSec and IKE, which is already very mature. macOS, iPhone, and Windows have mature IKEv2 support. Linux, and Android in particular, does not have mature IKEv2 support, at least not out-of-the-box. Implementations like FreeS/WAN are too complex and have too many pitfalls, which is why startups either avoid it or flounder in their attempts to build on it. If I could order open source engineers around, I'd order them to improve IKEv2 support. Why? Because IKEv2 addresses in a reasonable fashion 80% of the things that compromise the value-add of commercial VPN products. That last 20% still leaves maneuvering room for novel key and user management solutions, but without as great a risk of really f'ing things up.

Re: Vulnerabilities exploited in VPN products used worldwide

#52

> You need to enable JavaScript to run this app. Can someone provide a link to a page which isn't built by a retard?

Can you please follow the site guidelines when posting to HN, regardless of how annoying a web page is?

https://news.ycombinator.com/newsguidelines.html

Re: Vulnerabilities exploited in VPN products used worldwide

#53
post #30
post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

> Commercial enterprise VPN products are an open sewer, Commercial enterprise VPN products exist for one reason: To allow the enterprise security office to tick off the checkbox on the quarterly compliance forms that essentially says: "using a VPN to provide secure communications". Security is only a secondary consideration, if it is even considered at all.

Honestly, isn’t 90% of compliance like that? Checking boxes...

Re: Vulnerabilities exploited in VPN products used worldwide

#54
post #23

Earlier quoted context omitted.

How is having to conform to an audit performed by an external party as required by regulatory agencies or legislation "self-inflicted"?

Regulations (PCI at least) don't prevent you from making your own unaffected COTS VPN server. You may need a FIPS compliant HSM for keying and revocation control but if your a college educated IT professional in an enterprise environment this should be well within your scope. Of course we all know that's a lie. You could pick 10 random tech executives and none of them would know half the acronyms in this post. Why wo…

PCI is really rather “good” as far as external auditing bodies go, they give broad guidelines on the kind of policies they expect and it’s up to you to implement policies that make sense and they only seem to care about ensuring access controls and heavy amounts of auditing.

HIPPA however...

Re: Vulnerabilities exploited in VPN products used worldwide

#55
post #30
post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

> Commercial enterprise VPN products are an open sewer, Commercial enterprise VPN products exist for one reason: To allow the enterprise security office to tick off the checkbox on the quarterly compliance forms that essentially says: "using a VPN to provide secure communications". Security is only a secondary consideration, if it is even considered at all.

From my experience corporate VPNs exist to allow employees to access internal resources remotely. They aren't typically used for security although they can provide some form of security for remote workers.

Re: Vulnerabilities exploited in VPN products used worldwide

#56
post #10

>These vulnerabilities are well documented in open source. Seeing this awkward use of "open source" a lot lately. Its almost as if people think "readable on the internet for free" equals open source.

Open source as a term predates any software context.

It is an obscure term but it just isnt old enough or obsolete enough either way for it to be considered an archaic context

Re: Vulnerabilities exploited in VPN products used worldwide

#57
post #53
post #30

Earlier quoted context omitted.

> Commercial enterprise VPN products are an open sewer, Commercial enterprise VPN products exist for one reason: To allow the enterprise security office to tick off the checkbox on the quarterly compliance forms that essentially says: "using a VPN to provide secure communications". Security is only a secondary consideration, if it is even considered at all.

Honestly, isn’t 90% of compliance like that? Checking boxes...

The thing is, people are very good at checking boxes, and not very good at remembering important things.

So while it may seem inane, plain old checking boxes is almost certainly part of a good strategy for dealing with tedious, repetitive tasks where one error can cause serious issues - and this kind of security is probably one of those.

Obviously, it's not enough, nor an excuse to turn off your brain - but it's a pretty proven behavioral pattern.

Re: Vulnerabilities exploited in VPN products used worldwide

#58
Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented.

Companies that do BeyondCorp dont even have that level of protection. Most blindly follow that, without realizing that security of their internal systems is bad and therefore they should not do BeyondCorp. I have seen companies put their production infra without any fire walling out on the Internet (e.g jumpboxes and bastions) - that's also mind boggling.

Zero Trust is a journey not a solution....

Re: Vulnerabilities exploited in VPN products used worldwide

#59
post #23

Earlier quoted context omitted.

How is having to conform to an audit performed by an external party as required by regulatory agencies or legislation "self-inflicted"?

Regulations (PCI at least) don't prevent you from making your own unaffected COTS VPN server. You may need a FIPS compliant HSM for keying and revocation control but if your a college educated IT professional in an enterprise environment this should be well within your scope. Of course we all know that's a lie. You could pick 10 random tech executives and none of them would know half the acronyms in this post. Why wo…

For 99% percentage of all setups involving tunnels like this, key revocation (ala OCSP) is a security risk, not a solution. If your standard blindly requires or encourages this, what it's in effect encouraging is a much more complex and hard to audit set up that can much more easily include human error. As in, I've actually seen that happen. It's just waaaay to easy to have somebody, somewhere screw it up. Worse, you probably don't have full access to every agent in communication network like that, and if only one party messes it up...

So sure, if you're running a public service with all kinds of semi-anonymous users that have no preexisting side-channel, then you may really need all that infrastructure. But guess what? Most problems aren't like that. If you're just setting up a secure channel between a small set of known-in-advance actors then leverage that simplicity! You probably already have some pubkey based channel between them, so you don't need another one!

KISS. You should probably be using a shared token, not an asymmetric key, and definitely no revocation... if your system is simple enough to get away with that.

Re: Vulnerabilities exploited in VPN products used worldwide

#60
post #57
post #53

Earlier quoted context omitted.

Honestly, isn’t 90% of compliance like that? Checking boxes...

The thing is, people are very good at checking boxes, and not very good at remembering important things. So while it may seem inane, plain old checking boxes is almost certainly part of a good strategy for dealing with tedious, repetitive tasks where one error can cause serious issues - and this kind of security is probably one of those. Obviously, it's not enough, nor an excuse to turn off your brain - but it's a pr…

Sure I mean it’s a lot of CYA regulation-wise. Because if you chose a solution which is arguably better but not part of the list and the one on the list which is a worse solution isn’t checked, well you’d better have your resume ready when something happens.
Post reply on HN