Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad exit IPs are surprisingly identifying

tmctmt.com

Post reply on HN
Print view View original

331–340 of 408 posts

Re: Mullvad exit IPs are surprisingly identifying

#331

Post by righthand »

bstsb wrote: post #328
righthand wrote: post #306

Sounds like it’s time to drop Mullvad (their ui client is terrible chromium app anyways) and start using a selfhosted provider. This screams three-letter agency.

much anonymity provided by VPNs is through how many people use their exit nodes, “disguising” your traffic among others. also if you hosted your own VPN it would be trivial for one to find its host from an ASN, and from there subpoena your billing information

Sure but I’m not necessarily trying to hide my name from the law. And you dont get much disguise when your vpn company is compromised and logging it.

Re: Mullvad exit IPs are surprisingly identifying

#332

Post by retrochameleon »

trelane wrote: post #271
embedding-shape wrote: post #267

Earlier quoted context omitted.

Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset. Meanwhile, Mullvad is Swedish, and we tend to assume we all want to help build a better world together. Mix the two, and you get this conversation :)

> Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset American culture is highly varied. For some this is true, for others this is wrong and highly insulting. Maybe try a narrower brush next time.

I'm American. It's the pervasive culture. The brush doesn't need to be narrower.

Re: Mullvad exit IPs are surprisingly identifying

#333

Post by gchamonlive »

dns_snek wrote: post #142
gchamonlive wrote: post #74

Earlier quoted context omitted.

Can it get my IP? I'll go ahead and answer that it can't. It knows I'm mullvad user X, thus deanonimization, "it knows I use mullvad", but it doesn't know my original IP, so "it doesn't know I'm me".

I'm not sure what you're going for, your ISP-assigned IP doesn't tell them your legal name either. But when you connect to the site from via server A and later via server B they can tell that you're the same person. And they can deanonymise you through data brokers. All Mullvad IPs are traceable back to the same number (acting as a pseudo account identifier) so if you ever entered your PII on any website when using M…

None of which is mullvad's fault, as you acknowledge, and none of it in the scope of the article, so I guess my point stands? No browser fingerprinting there, nothing explicitly about side channels...

Re: Mullvad exit IPs are surprisingly identifying

#334

Post by overfeed »

illiac786 wrote: post #104
overfeed wrote: post #102

Earlier quoted context omitted.

> It does significantly lower the bars for identifying you though, but the requirements are still high If you squint a bit, it looks a lot like a "Nobody But US" (NOBUS[1]) scheme. A few more identifying bits could tip the scale for party that has a whole host of other bits on a list of suspects, without being useful to most other people. 1. https://en.wikipedia.org/wiki/NOBUS

You definitely need glasses then. Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.

The attack surface is far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses.

Knowing the online services one uses, and the times (to the millisecond) they used them goes a long way to deanonymize individuals. Correlating Internet routing events is very effective when combined with other data sources, like physical surveillance and knowing the exact times the target got home, or interacted with their phone after getting a DM alert.

Re: Mullvad exit IPs are surprisingly identifying

#335

Post by autoexec »

fragmede wrote: post #279
autoexec wrote: post #242

Earlier quoted context omitted.

I do think hitting "send" on the email to the responsible party immediately before publishing (or at least notifying them as quickly as you can afterwards) is a smart thing to do. I mean, why wouldn't you? My concern was more about the "Not having a bug bounty or dedicated email address does not make it OK to go public immediately" comment. It can sometimes be difficult to track down the right person to notify and so…

Depending on the severity of the issue. Emailing support with a draft of the blog post and waiting even a couple of hours for a response so they can fix it first would have been more responsible than dropping the blog post to the whole wide world and catching Mullvad with their pants down.

Why wait for a couple of hours for a response while people who could protect themselves are getting harmed? It's especially true when you don't know if the maintainer/vendor will get back to you at all, or if they even check their mailboxes regularly.

The priority should be on protecting users, and not helping the company responsible for the vulnerability save face, or give them extra time to spin up their PR team, or get a head start on a patch.

When the risk to users is low, or when there's really nothing users can do to protect themselves anyway I'd agree with you. In a case like this where the risk to users can be extremely high, and the moment they are made aware of the problem there are steps the user can take to eliminate that risk, the safety of those users should outweigh inconvenience to the people responsible for the vulnerability

Re: Mullvad exit IPs are surprisingly identifying

#336

Post by sorcix »

alt227 wrote: post #314
graemep wrote: post #310

Earlier quoted context omitted.

I have known doctors and lawyers and many others to do work pro-bono

Without the patient or client asking?

Well, yes. People have been diagnosed with skin cancer when a doctor saw a picture of them in an article and reached out to them.

Re: Mullvad exit IPs are surprisingly identifying

#337

Post by dennysora »

kfreds wrote: post #178

I work at Mullvad. (co-CEO, co-founder) Some aspects of the described behavior are as we intended and some are not. The cause is not exactly as described in the blog post. As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure. If any of you try to reproduce the blog post's findings you may get confusing results throughout the day. We will also re-evaluate wheth…

Thank you! As a staunch supporter of Mullvad, you are the only VPN provider I recommend for cybersecurity, especially in today's landscape where VPNs are facing increasing regulatory restrictions. Thank you so much!

Re: Mullvad exit IPs are surprisingly identifying

#338

Post by illiac786 »

overfeed wrote: post #334
illiac786 wrote: post #104

Earlier quoted context omitted.

You definitely need glasses then. Let me specify: The user must have entered his data on one site which the attacker has control of. That is a high bar still.

The attack surface is far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses. Knowing the online services one uses, and the times (to the millisecond) they used them goes a long way to deanonymize individuals. Correlating Internet routing events is very effective when combined with other data sources, like physical surveillance and knowin…

What’s the difference if Mullvad did not have the vulnerability described above?

Re: Mullvad exit IPs are surprisingly identifying

#339

Post by dongcarl »

kfreds wrote: post #178

I work at Mullvad. (co-CEO, co-founder) Some aspects of the described behavior are as we intended and some are not. The cause is not exactly as described in the blog post. As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure. If any of you try to reproduce the blog post's findings you may get confusing results throughout the day. We will also re-evaluate wheth…

Carl here (Obscura CEO, one of Mullvad's partners)

This was an interesting finding, though as kfreds mentioned it would have been better to notify the vendor before publishing.

The main finding (IP-position-in-pool correlation between servers) seems to include genuinely unintended behaviour. Given our great experience with the Mullvad team, I'm sure this will be addressed soon.

In general, if you want different "identities", you should make sure to rotate or use different WireGuard keys.

One small thing from the article I'll comment on:

> Surprisingly, the exit IP you are given is not randomized each time you connect to the server, but deterministically picked based on your WireGuard key, which rotates every 1 to 30 days (unless you use a third-party client, in which case it never rotates).

Context: WireGuard is by design[1] a "Connection-less Protocol", there's no concept of a connection, there's only a "re-keying handshake" (key here refers to the ephemeral Diffie-Hellman key, not the WireGuard key) every 2-3 minutes ONLY IF there's traffic flowing.

The above statement is not too surprising if you consider the counterfactual: What would happen if, even with the same WireGuard key, the exit IP were randomized each time you "connect" to the server (say each time there is a "re-keying handshake" or at more frequent cadence (e.g. every 15 minutes) than the WireGuard key rotation).

In this scenario, ~every 15 minutes:

- At the Transport layer, all your in-tunnel connections that are on non-roaming protocols (basically everything except QUIC) would be disrupted, and the connections would have to be re-established.

- At the Application layer, many application-level sessions that treat "same cookie, new IP" as suspicious would trigger logouts, CAPTCHAs, or risk scoring.

Both are terrible UX, and what's worse would also make users much more uniquely fingerprintable ("this person keeps reconnecting from a different IP, they must be using Mullvad").

[1]: https://www.wireguard.com/protocol/

Re: Mullvad exit IPs are surprisingly identifying

#340

Post by pseudalopex »

PhilipRoman wrote: post #140
illiac786 wrote: post #98

Earlier quoted context omitted.

Why not? Why can’t it be the purpose of a given VPN service?

If you use the VPN for the Web, browser fingerprinting is a major threat outside of specialized scenarios

Mullvad have a Tor Browser fork for this reason.
Post reply on HN