IP leak affecting VPN providers with port forwarding

IP leak affecting VPN providers with port forwarding

Nov 26, 2015 by Perfect Privacy

Vulnerability “Port Fail” reveals real IP address

We have discovered a vulnerability in a number of providers that allows an attacker to expose the real IP address of a victim. “Port Fail” affects VPN providers that offer port forwarding and have no protection against this specific attack. Perfect Privacy users are protected from this attack.

This IP leak affects all users: The victim does not need to use port forwarding, only the attacker has to set it up.

We have tested this with nine prominent VPN providers that offer port forwarding. Five of those were vulnerable to the attack and have been notified in advance so they could fix this issue before publication. However, other VPN providers may be vulnerable to this attack as we could not possibly test all existing VPN providers.

Details about the leak

The attacker needs to meet the following requirements:

• Has an active account at the same VPN provider as the victim
• Knows victim’s VPN exit IP address (can be obtained by various means, e.g. IRC or torrent client or by making the victim visit a website under the attackers control)
• The attacker sets up port forwarding. It makes no difference whether the victim has port forwarding activated or not.

The IP leak can then be triggered as follows:

1. Victim is connected to VPN server 1.2.3.4
2. Victim’s routing table will look something like this:
   0.0.0.0/0 -> 10.0.0.1 (internal vpn gateway ip)
   1.2.3.4/32 -> 192.168.0.1 (old default gateway)
3. Attacker connects to same server 1.2.3.4 (knows victim’s exit through IRC or other means)
4. Attacker activates port forwarding on server 1.2.3.4, example port 12345
5. Attacker gets the victim to visit 1.2.3.4:12345 (for example via embedding <img src=”http://1.2.3.4:12345/x.jpg”> on a website)
6. This connection will reveal the victim’s real IP to the attacker because of the “1.2.3.4/32 -> 192.168.0.1” vpn route.

The crucial issue here is that a VPN user connecting to his own VPN server will use his default route with his real IP address, as this is required for the VPN connection to work. If another user (the attacker) has port forwarding activated for his account on the same server, he can find out the real IP addresses of any user on the same VPN server by tricking him into visiting a link that redirects the traffic to a port under his control.

Also note that due to the nature of this attack all VPN protocols (IPsec, OpenVPN, PPTP, etc.) and all operating systems are affected.

Mitigation

Affected VPN providers should implement one of the following:

• Have multiple IP addresses, allow incoming connections to ip1, exit connections through ip2-ipx, have port forwarding on ip2-ipx
• On Client connect set server side firewall rule to block access from Client real ip to port forwardings that are not his own.