Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerabilities exploited in VPN products used worldwide

ncsc.gov.uk

Post reply on HN
Print view View original

71–80 of 140 posts

Re: Vulnerabilities exploited in VPN products used worldwide

#71

Post by gz5 »

The architecture (of classic VPN) is the vulnerability. imo, we need to move towards architectures which design in:

+ Least privileged access and isolation. Worst-case, 5-tuple, session-by-session. Best-case, app level bindings, independent of addressing. Isolation to prevent lateral attacks.

+ Zero trust. Yes the ZT term seems to have been taken over by marketing, but the architecture itself is sound.

+ Telemetry data for proper visibility.

+ Programmable-by-Design. Integrate into overall app and security constructs and tooling; no (mainly) separate VPN islands.

Re: Vulnerabilities exploited in VPN products used worldwide

#72

Post by labawi »

tptacek wrote: post #70
ohazi wrote: post #68

Earlier quoted context omitted.

If all of my remote access can be done via ssh {+ local/remote forwarding}, is there a reason for me to consider wireguard?

Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…

> WireGuard .. is practically bulletproof in terms of keeping connections alive

Try switching between IPv4 and IPv6 networks, or reaching a peer on non-default/primary network on Windows.

Not denying it would usually have better connectivity than TCP based ssh.

Re: Vulnerabilities exploited in VPN products used worldwide

#73

Post by jonas21 »

Havoc wrote: post #10

>These vulnerabilities are well documented in open source. Seeing this awkward use of "open source" a lot lately. Its almost as if people think "readable on the internet for free" equals open source.

In this case, I think they're using "open source" in the intelligence sense, meaning publicly available [1]. NCSC is part of the GCHQ (UK intelligence agency) after all.

[1] https://en.wikipedia.org/wiki/Open-source_intelligence

Re: Vulnerabilities exploited in VPN products used worldwide

#74

Post by paulddraper »

mc32 wrote: post #53
pwg wrote: post #30

Earlier quoted context omitted.

> Commercial enterprise VPN products are an open sewer, Commercial enterprise VPN products exist for one reason: To allow the enterprise security office to tick off the checkbox on the quarterly compliance forms that essentially says: "using a VPN to provide secure communications". Security is only a secondary consideration, if it is even considered at all.

Honestly, isn’t 90% of compliance like that? Checking boxes...

Having worked a lot with security compliance, I'll say there are two types of things you do:

1. The things for compliance.

2. The things for security.

Only rarely does something fit in both categories.

Re: Vulnerabilities exploited in VPN products used worldwide

#75

Post by tptacek »

dijit wrote: post #54
JackRabbitSlim wrote: post #47

Earlier quoted context omitted.

Regulations (PCI at least) don't prevent you from making your own unaffected COTS VPN server. You may need a FIPS compliant HSM for keying and revocation control but if your a college educated IT professional in an enterprise environment this should be well within your scope. Of course we all know that's a lie. You could pick 10 random tech executives and none of them would know half the acronyms in this post. Why wo…

PCI is really rather “good” as far as external auditing bodies go, they give broad guidelines on the kind of policies they expect and it’s up to you to implement policies that make sense and they only seem to care about ensuring access controls and heavy amounts of auditing. HIPPA however...

I do not often hear people describe PCI as "rather good", for what it's worth. "An industry scourge" is a more common sentiment.

Re: Vulnerabilities exploited in VPN products used worldwide

#76

Post by GordonS »

GhettoMaestro wrote: post #12
tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

Lots of loose language in your post. Show me a FIPS140-2 Wireguard implementation.

Unfortunately, if you sell crypto software to the defence sector in the US or Europe, FIPS is still a thing.

As someone in the infosec space, it still boggles my mind that anyone gives a flying feck about FIPS, especially after the Snowden/NIST revelations, and after even Microsoft has recommended to disable FIPS mode in Windows.

Thankfully I think it's on it's last legs - people are realising it's more a curse than a blessing. Single data point and all that, but I've had far fewer FIPS-related queries in recent years - and for the first time, some of those I have had are from defence sector companies asking how to ensure FIPS mode is not activated!

I'd encourage the WireGuard devs to not waste any time and money on FIPS validation.

Re: Vulnerabilities exploited in VPN products used worldwide

#77

Post by xyzzy_plugh »

labawi wrote: post #72
tptacek wrote: post #70

Earlier quoted context omitted.

Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…

> WireGuard .. is practically bulletproof in terms of keeping connections alive Try switching between IPv4 and IPv6 networks, or reaching a peer on non-default/primary network on Windows. Not denying it would usually have better connectivity than TCP based ssh.

Where do you encounter IPv6 in the wild?

Re: Vulnerabilities exploited in VPN products used worldwide

#78

Post by xyzzy_plugh »

kerng wrote: post #58

Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented. Companies that do BeyondCorp dont even have that level of protection. Most blindly follow that, without realizing that security of their internal systems is bad and therefore they should not do BeyondCorp. I have seen companies put their production infra without any fire walling ou…

BeyondCorp isn't incompatible with VPN solutions -- if anything they're highly complementary. Why not use both?

Re: Vulnerabilities exploited in VPN products used worldwide

#79

Post by labawi »

eeZah7Ux wrote: post #38
ihuman wrote: post #9

Earlier quoted context omitted.

Why do you prefer Wireguard over Openvpn?

Wireguard codebase is tiny at it has been reviewed by a lot of skilled eyeballs.

> it has been reviewed by a lot of skilled eyeballs.

Any details on this?

It's probably better than the mess of other code bases, but wireguard is in active development, so even if secure and bug-free a few months ago, it would not necessarily imply secure now.

Re: Vulnerabilities exploited in VPN products used worldwide

#80

Post by nosezinc »

dijit wrote: post #54
JackRabbitSlim wrote: post #47

Earlier quoted context omitted.

Regulations (PCI at least) don't prevent you from making your own unaffected COTS VPN server. You may need a FIPS compliant HSM for keying and revocation control but if your a college educated IT professional in an enterprise environment this should be well within your scope. Of course we all know that's a lie. You could pick 10 random tech executives and none of them would know half the acronyms in this post. Why wo…

PCI is really rather “good” as far as external auditing bodies go, they give broad guidelines on the kind of policies they expect and it’s up to you to implement policies that make sense and they only seem to care about ensuring access controls and heavy amounts of auditing. HIPPA however...

You have it backwards. PCI is prescriptive about specific ways you have to implement security, including certain requirements that make very little sense. HIPAA gives broad guidelines and you have flexibility as to how to meet those requirements. You can use a more prescriptive framework such as HITRUST to meet the HIPAA requirements, but you don't have to.
Post reply on HN