IPsec Vulnerabilities and Software Security Prediction

https://www.altsci.com/ipsec/

by wglb • 11 years ago

46 40 11 years ago

616c6• 11 years ago

So I know many people use OpenVPN these days, but does anyone use L2TP/IPSec or IPSec? I asked because when recently searching this topic, despite the author mentioning lots of dated materials, most of what I find is archaic. This post mentions ipsec-tools, but it has been clear that since the IPSec changes/patches went inline into the kernel for 2.6.x and beyond, these have slowly become more relevant over time, and that ipsec-tools and/or raccon to do L2TP and IPSec or pure IPSec is generally outdated and now only really suited to the BSDs because, as the articles mentions, it is more germane to that architecture.

And the difference between FreeSWAN, LibreSWAN, and StrongSWAN was very confusing to me unitl I read this.

http://serverfault.com/questions/173158/strongswan-vs-opensw...

I mean setting up VPN is no trivial pursuit, but the amount of effort to set any of these up to use native VPN clients for my mobile (Android devices) encouraged me to potentially consider StrongSWAN once I really review the documentation and learn as much as I can.

What are others doing?

Thanks for the cool article either way.

feld2• 11 years ago

These days for VPNs it's hard to beat OpenVPN with TLS auth enabled and using keys, not passwords/passphrases.

brunoqc3• 11 years ago

Why not passwords with LDAP and a psk?

dhess2• 11 years ago

I use IPsec in addition to OpenVPN, primarily because that's all iOS used to support. Since iOS 5 or 6 (I think; maybe even as late as version 7?), Apple has allowed third-party VPN apps, so with an "official" OpenVPN client now available in the iOS App Store, it's not as important as it was. However, I've left it running as a fallback solution to OpenVPN (some hotel firewalls, for example, permit IPsec but actively block UDP-based OpenVPN).

I use ipsec-tools, as circa 2012 when I was originally setting this up, it was the only free software IPsec solution I could get to work with iOS clients, but based on this vulnerability I've now disabled it and will try StrongSWAN again.

brunoqc3• 11 years ago

You can also use OpenVPN on port 443 as a last resort (only as a last resort since TCP over TCP is a bad idea[1])

1- https://news.ycombinator.com/item?id=2409090

fencepost• 11 years ago

There are a lot of places using IPSec VPNs for point-to-point connections, in part because there's an awful lot of equipment out there that supports them.

Heck, Cisco's "Small Business" RV router series (RV042/RV082/RV016/RV042G and possibly others) are still being sold after several hardware revisions (still kind of long in the tooth), and they support all of two VPN types: IPSec and PPTP.

616c6• 11 years ago

Oh, I am aware. I work in a such an org with the Cisco IPSec system. I have mutliple that I use/evaluate for work purposes, but when I asked this I am more interested in the open systems not tied to a dedicated appliance, or at least can do both (I see "OpenVPN appliances" advertised on the OpenVPN page these days).

ryan-c2• 11 years ago

I run transport mode IPSec on my LAN at home under Linux with racoon to encrypt NFS with certificate based auth. It was a huge pain in the ass.

616c6• 11 years ago

You got a write-up on that? It sounds like a daunting task, so funny blog post with profanity about Linux config (used to write them, no one would read them) are something I really enjoy.

So definitely write about that. There is so much bullshit and misinformation I have read this week alone on VPN config in *nix environments, it's astounding. My shakiness was only confirmed by this article.

drzaiusapelord• 11 years ago

but does anyone use L2TP/IPSec or IPSec

IPSec is still the enterprise defacto standard. Its pretty much everywhere.

Yeah, it a little different for the FOSS home hobbyist, but for companies with a budget, its a trivial addition to their infrastructure (Cisco, Sonicwall, etc). FOSS IPSec implementations seem to be pretty non-existant in practice from my own experience and I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed).

noinsight• 11 years ago

I only see FOSS-only shops using OpenVPN, which is OpenSSL based (which, of course, suffered from heartbleed).

Exactly. I'd love to see a simple, auditable and secure open source VPN software. (not OpenVPN)

api• 11 years ago

IPSEC is a usability nightmare, mostly on account of the implementations.

616c6• 11 years ago

Well, I was under the impression that projects like Streisand exist because OpenVPN is no cake-walk either.

https://github.com/jlund/streisand

EDIT: Forgot the link, like a proper idiot.

billyhoffman2• 11 years ago

We use L2TP/IPSec to VPN into our AWS VPC. Amazon's VPN solutions aren't great, and propping up a VPN endpoint on a micro instance and an elastic IP is fairly easy. Also makes it easier to SSH/RDP/MySQL to instances in your private subnet from trusted developer machines at our office. L2TP/IPSec is built in to modern versions of OS X and Windows (though for Windows you have to tweak hidden settings to work with NAT properly)

john_oshea• 11 years ago

If you have time to link to somewhere listing those hidden settings, that would be really helpful.

bcook3• 11 years ago

Someone once told me, "you are far too interested in what you have to say". I think that applies to this write-up.

I mean, it was educational and somewhat entertaining, but the lack of professionalism bothers even me, and that's saying something... Just stick to the technical aspects so that people can fix this as quickly as possible.

With all due respect, find a more appropriate soap-box next time. All the ranting simply caught me off guard in a 0-day announcement.

0xdeadbeefbabe2• 11 years ago

The reason I found this vulnerability is because I made the mistake of following someone's IPsec How-To. Don't trust How-Tos written ten years ago. Don't trust How-Tos written yesterday.

Finding the vulnerability leaves him full of confused regret?

Relativism and Utilitarianism are not a valid excuse for doing harm. A person who does harm consistently marks himself or herself as a bad actor. It is our job to name them and reduce harm.

The rhetoric doesn't fit reality so much. Like you said stick to the technical facts, so moral people everywhere can "do the right thing".

Javantea_5• 11 years ago

Thank you for your critical comments.

I find that when I keep my opinions to myself, people assume that something very different than what I am thinking. I have become more outspoken recently as I have found that people are more willing to listen to and argue things that they disagree with if they trust the person saying it (yourself perhaps?).

The audience of this document was the TA3M Seattle group, which is very different from the average tech audience. It was a mix of people who are programmers and people who are not. I tried to put the subject area into both areas. If I was speaking to a tech audience, I would have made the paper more like this: https://www.altsci.com/ipsec/ipsec-tools-sa.html and simply described the problem of software security prediction instead of trying to give people actionable advice and the reason why.

So this document attempts to give people 0-day and the motivations behind naming software as unmaintained. I think that most people don't understand how many hours I spent trying to report my findings (~20 hours) when finding the vulnerability took just 3-4 hours. If we want secure software, we need to remove IPsec-tools and similarly unmaintained software from the open source ecosystem so that we don't spend 20 hours trying to contact them every time we find a vulnerability.

redwards5104• 11 years ago

While I agree with you, I am also inclined to think "well, it's his find. He's entitled to say whatever he wants." And in his defense, he follows the inverted pyramid structure of putting the vital information up front. Heck, he even included the line of code that causes the issue. I rarely see that!

bcook3• 11 years ago

He definitely explained things well and proved he has a deep understanding of the larger situation. I wish more people were so involved and passionate about their field of work.

Javantea_5• 11 years ago

Thank you for the comment. I didn't have enough time to finish the paper, so it is more than a little rough around the edges. I have intentionally reduced professionalism in this paper to save time and energy so that I can spend it on more effective pursuits. The reason I tacked on the whole question of "Was IPsec itself poorly designed?" "Why didn't this get reported in 2013?" "What should we do about software vulnerability?" was to get interest from people who generally get nothing from a vulnerability announcement in software they don't use. Thus, the audience of this paper is very different from the traditional audience of people who read vulnerability announcements by the hundreds. Like another user commented, I tried very hard to put the important stuff first so that people like you could stop reading when they became disinterested.

You have convinced me to release a version of the report without the soapbox for people like you: https://www.altsci.com/ipsec/ipsec-tools-sa.html

bcook3• 11 years ago

Although my post did have legitimate reasons for criticizing, I really just meant to poke a little fun at someone who is obviously more dedicated and passionate than the majority.

I meant no harm. You are most probably accomplishing the types of things in the security field that I can only dream about. /me stares off into space, thinking of a day when I might discover a vital 0-day.

Congrats on the discovery!

twunde• 11 years ago

FYI, this seems to affect some configurations but not all configurations. I've had one member of the NYC BSD group ran these against his IPSec configuration with just errors, but then set up a IPSec using the OP's configuration and was able to reproduce the coredumps.

Javantea_5• 11 years ago

Thank you very much for testing this exploit. The vulnerability is in gssapi.c which is only compiled in if HAVE_GSSAPI is defined. This is an optional configuration parameter, so it sounds like the configuration you tested did not have GSSAPI/kerberos enabled. That's good news for users who have a similar setup, it will give them ample time to switch to a different IPsec implementation.

redwards5104• 11 years ago

What does GLSA stand for? It's near the bottom where he is listing software that should be replaced. It sounds like it means "vulnerability".

Javantea_5• 11 years ago

Gentoo Linux Security Advisories. See here: https://security.gentoo.org/glsa/

redwards5104• 11 years ago

Is the number of vulnerabilities for a product really a good indicator of it's quality? I seem to remember a year-end report showing Google Chrome as the browser with the most number of security bugs found, but some people said that was because they pay the most in their bug bounty program.

bredanbrooke• 11 years ago

I would recommend IPVanish with exceptional performance combined with outstanding online security, IPVanish VPN will keep you from all kinds of threats present on the internet and it allow internet freedom. With 150+ servers located all over the world as well as securing your data with safe encryption tunnels along with protocols, IPVanish will be away cyber-goons and also protect your privacy. Take a look at this review http://www.bestvpnprovider.com/ipvanish-review/

IPsec Vulnerabilities and Software Security Prediction

Related Stories