1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

OpenVPN Vulnerability

Discussion in 'Asuswrt-Merlin' started by SMS786, Aug 20, 2018.

  1. SMS786

    SMS786 Regular Contributor

    Joined:
    Nov 29, 2017
    Messages:
    168
    https://www.tomsguide.com/us/vpn-voracle-attack-defcon26,news-27784.html

    https://www.bleepingcomputer.com/ne...k-can-recover-http-data-from-vpn-connections/

    This attack was revealed at DEF CON last week. Apparently protecting against this vulnerability is as easy as disabling compression on our OVPN servers?

    @RMerlin, do you have any recommendations?
     
    Last edited: Aug 20, 2018
  2. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    29,069
    Location:
    Canada
    Nothing more than what's already said in the article: avoid using LZO compression. Most of today's Internet data can't be compressed any further anyway (either it's encrypted, or it's jpeg/mp3/mp4/zip).

    It's another one of these "security exploits" over which I won't be losing any sleep, personally... Likelyhood of this being actively exploited in the wild against generic/random victims is next to nil.
     
    martinr and SMS786 like this.
  3. SMS786

    SMS786 Regular Contributor

    Joined:
    Nov 29, 2017
    Messages:
    168
    Got it, thanks much for the clarification!
     
  4. netware5

    netware5 Senior Member

    Joined:
    Mar 9, 2013
    Messages:
    338
    Location:
    Bulgaria
    LZ4 compression is much better and faster. Does the above vulnerability affects the LZ4 also?
    And second question is: Does setting of tls-crypt option helps in such circumstances?
    And finally third question: What about TAP configurations when the OpenVPN encapsulates not IP packets but Ethernet frames?
     
    Last edited: Aug 21, 2018
  5. joe scian

    joe scian Regular Contributor

    Joined:
    Apr 22, 2018
    Messages:
    119
    since the VORACLE attack report refers to compression only and makes no distinction between LZO , adaptive or LZ4 then you can assume that LZ4 is included.
     
  6. Wadadli

    Wadadli Occasional Visitor

    Joined:
    Aug 16, 2017
    Messages:
    15
  7. DonnyJohnny

    DonnyJohnny Very Senior Member

    Joined:
    Dec 17, 2017
    Messages:
    670
    Looking at the requirements needed to complete that Attack..
    it is not easily to hack.

    1. They need to be on the same network as you;
    2. You need to be using an HTTP connection;
    3. You need to be using a browser vulnerable to VORACLE (anything but Chrome);
    4. You need to visit a website that the hacker controls;
    5. You need to be using OpenVPN with compression engaged.
    The only chance will only be if you using a unknown wifi hotspot and they used a http log-in page. Otherwise, the chance is very Low.

    But I think turning off the compression is a good way to totally prevent things from happening.
     
    SMS786 likes this.
  8. 58chev

    58chev Regular Contributor

    Joined:
    Mar 14, 2018
    Messages:
    55
    Location:
    Etobicoke, Canada
    Set compression to "NONE" or "DISABLE" ?
     
  9. Here's some clarification on both options:

    I use 'Disabled' for the VPN Server running on my router. My VPN provider (and several others) have completely disabled compression as well (source: https://protonvpn.com/blog/voracle-attack/), so regardless what a client requests, it won't offer any compression on negotiating.
     
    SMS786 likes this.
  10. LouisvilleUK

    LouisvilleUK Occasional Visitor

    Joined:
    Dec 1, 2015
    Messages:
    36
  11. @RMerlin Would it be possible to set the Compression value to 'Disable' by default?

    Unrelated to Voracle, but would you please consider setting "Username / Password Auth. Only" to 'No' by default? @Martineau pointed out yesterday that 'Yes' is less secure. For people with less knowledge, like yours truly, I think setting ('the most') secure options by default would definitely come in handy.
     
  12. RMerlin

    RMerlin Super Moderator

    Joined:
    Apr 14, 2012
    Messages:
    29,069
    Location:
    Canada
    Worth considering, tho personally I'm not losing any sleep over that particular issue since the issue is more likely to affect you when you are using a client to access the Internet, not when using it just to connect remotely into your home network. Therefore that makes it far more critical for all those VPN tunnel providers whose sole purpose is to let you redirect your traffic through them.

    Less does not mean it's insecure, just like your home doorlock is less secure than one used on a store or a bank, or AES-128-GCM is less secure than AES-256-GCM. The learning curve to deal with generating your own client certificates is far too steep for the vast majority of users, so I have no intention of changing the default settings.

    EDIT: actually, the reasons for this default choice are historical. My original implementation didn't generate a client key/cert pair, it had to be done manually by the end user. Afterward Asus implemented the functionality to automatically generate a key/cert pair for the client. I just rechecked that code, and I see they are automatically used in the exported client config file now, therefore it should be possible to change the default to not be username/password only. That wasn't the case back then.
     
    Last edited: Oct 3, 2018
  13. 58chev

    58chev Regular Contributor

    Joined:
    Mar 14, 2018
    Messages:
    55
    Location:
    Etobicoke, Canada
    Thank you [email protected] for the clarification.
     
    [email protected] likes this.
  14. TheStork

    TheStork Occasional Visitor

    Joined:
    Nov 24, 2014
    Messages:
    17
    So just to check: is the compression option ‘None’ also safe from this exploit?

    On my OpenVPN server setup it seems that ‘Disabled’ kills access for the clients (they connect but cannot access anything), while ‘None’ seems to work. I’d prefer to not have to reissue all client configs...
     
  15. SMS786

    SMS786 Regular Contributor

    Joined:
    Nov 29, 2017
    Messages:
    168
    I had a similar predicament. After "Disabling" compression on my server I had to delete the following line from my config files:
    Code:
    comp-lzo XXXXX
    The connections worked fine afterwards.

    As to having the "None" option being as secure as "Disabled" - I can't speak to that..but I would definitely err on the side of caution.