Friday, May 24, 2024

Critical Linux Vulnerability Let Hackers Hijack VPN-Tunneled TCP Connections

Researchers from the University of New Mexico uncovered a critical Linux vulnerability that affects most of the Linux distros, allows attack Inferring and hijacking VPN-tunneled TCP connections.

The vulnerability also allowed to inject the data into the TCP stream and hijack connections through determining the exact seq and ack numbers by counting encrypted packets and analyse the size.

The severe Linux vulnerability can be tracked as CVE-2019-14899 and affects the other services such as Systemd, Google, Apple, OpenVPN, and WireGuard.

All Linux Distro’s are Vulnerable

Researchers tested most of the following Linux distributions and found that all are vulnerable including Linux distros that use a version of systemd pulled after November 28th, 2018.

  • Ubuntu 19.10 (systemd)
  • Fedora (systemd)
  • Debian 10.2 (systemd)
  • Arch 2019.05 (systemd)
  • Manjaro 18.1.1 (systemd)
  • Devuan (sysV init)
  • MX Linux 19 (Mepis+antiX)
  • Void Linux (runit)
  • Slackware 14.2 (rc.d)
  • Deepin (rc.d)
  • FreeBSD (rc.d)
  • OpenBSD (rc.d)

The discovered vulnerability has been confirmed its existence in Linux, FreeBSD, OpenBSD, macOS, iOS, and it allows the malicious access point to determine whether the connected user is using a VPN, websites that they are visiting and also allowed attackers to inject data into the TCP stream.

Researchers also confirmed that the vulnerability also works against OpenVPN, WireGuard, and IKEv2/IPSec. But not work against TOR since it operates in a SOCKS layer and includes authentication and encryption that happens in userspace.

Researchers clarifies that “It should be noted, however, that the VPN technology used does not seem to matter and we are able to make all of our inferences even though the responses from the victim are encrypted, using the size of the packets and number of packets sent (in the case of challenge ACKs, for example) to determine what kind of packets are being sent through the encrypted VPN tunnel.”

The Attack Setup & Component

There are 3 steps and 4 components need to reproduce this attack.

3 Steps:

  1. To determine the VPN client’s virtual IP address
  2. Using the virtual IP address to make inferences about active connections
  3. Using the encrypted replies to unsolicited packets to determine the sequence and acknowledgment numbers of the active connection to hijack the TCP sessions

4 Components :

  1. The Victim Device (connected to AP, 192.168.12.x,
  2. AP (controlled by the attacker,
  3. VPN Server (not controlled by the attacker,
  4. A Web Server (not controlled by the attacker, public IP in a real-
    world scenario)

This attack does not work against any Linux distribution until the release of Ubuntu 19.10 and the Amazon AWS employee confirmed that Amazon Linux and our VPN products; aren’t impacted by this issue.

Possible VPN-Tunneled TCP connections attack mitigation suggested by researchers:

1. Turning reverse path filtering on
2. Bogon filtering
3. Encrypted packet size and timing

You can read the complete analysis of this vulnerability report here.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Also Read

Critical Wi-Fi Bug In Linux Let Hackers Take Complete Control and Crash The System Remotely


Latest articles

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...

Beware Of HTML That Masquerade As PDF Viewer Login Pages

Phishing attacks have evolved into increasingly sophisticated schemes to trick users into revealing their personal information.One such method that has gained prominence involves...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles