Vulnerabilities exploited in VPN products used worldwide

Post by tptacek » Sat, Oct 05, 2019, 4:21 AM UTC

elcritch wrote: post #101

tptacek wrote: post #7

Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.

WireGaurd keeps getting mentioned as the new alternative to OpenVPN, but it sounds like it isn’t available on a lot of BSD’s and doesn’t have much for GUI’s and the like for configuration. Why would I want to use WireGaurd compared to something like ZeroTier as a VPN layer? Maybe I’m more of a programmer and the notion of a decent api controller for authentication seems nice.

Post by zokula » Sat, Oct 05, 2019, 4:43 AM UTC

tptacek wrote: post #70

ohazi wrote: post #68

Earlier quoted context omitted.

If all of my remote access can be done via ssh {+ local/remote forwarding}, is there a reason for me to consider wireguard?

Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…

Post by antonvs » Sat, Oct 05, 2019, 5:01 AM UTC

generatorguy wrote: post #96

morpheuskafka wrote: post #92

Earlier quoted context omitted.

Some protocols/services are designed with a local network in mind and would require modifications to work on the internet. A VPN is invisible to the apps and can easily save a lot of work in a large IT environment with numerous internal services.

How is a local network different from the internet, presuming there is no firewall or nat between the client and the server ?

Post by fulafel » Sat, Oct 05, 2019, 5:54 AM UTC

lwf wrote: post #84

chelmzy wrote: post #55

Earlier quoted context omitted.

From my experience corporate VPNs exist to allow employees to access internal resources remotely. They aren't typically used for security although they can provide some form of security for remote workers.

Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine , not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often t…

Post by pjmlp » Sat, Oct 05, 2019, 7:14 AM UTC

gz5 wrote: post #71

The architecture (of classic VPN) is the vulnerability. imo, we need to move towards architectures which design in: + Least privileged access and isolation. Worst-case, 5-tuple, session-by-session. Best-case, app level bindings, independent of addressing. Isolation to prevent lateral attacks. + Zero trust. Yes the ZT term seems to have been taken over by marketing, but the architecture itself is sound. + Telemetry da…