You can add OpenVPN to the growing list of products and services vulnerable to the Heartbleed OpenSSL vulnerability. Worse, researchers have been able to chain together exploits to steal private keys from traffic moving through the open source virtual private network software package.
A Swedish VPN company called Mullvad reported its findings to OpenVPN this week, which quickly urged users to update their OpenSSL library, revoke old private keys, generate new ones and create new certificates for the new private keys.
This process is going on worldwide for companies and Web-based services vulnerable to the bug in the OpenSSL crypto library’s heartbeat functionality. The bug returns 64KB of memory to any client or server making a request; if the pings are made often enough, an attacker could see in plaintext anything from user credentials to enough data to piece together a private SSL key.
Fredrik Stromberg, cofounder of Mullvad, said his company was able to extract “private key material” using a known Heartbleed proof-of-concept exploit. Stromberg told Threatpost that attacks against OpenVPN are a little more complicated because TLS session traffic is wrapped inside the OpenVPN protocol. Stromberg had to write a script that cracked the OpenVPN protocol and then used a Heartbleed exploit to dump memory similar to other attacks against Web servers, for example.
“What I did was I left it continuously running overnight pounding on my test server,” Stromberg said. “When I woke up in the morning, let’s say I had more than 1GB and less than 10GB in memory dumps, and found enough key material to reproduce a key.”
Stromberg joins a growing list of security researchers who have been able to extract private keys via Heartbleed exploits—a worst-case scenario. Most of the previous success stories were achieved through the CloudFlare Challenge against a purpose-built Web server. This is the first successful attempt against VPN software.
“You need to know how the VPN works, but this specification is open. It’s a little more advanced than a normal Heartbleed exploit, but not very hard if you’re a competent programmer.”
OpenVPN acknowledged Stromberg’s findings and replacing the keys for each peer that was active while linked against a vulnerable OpenSSL session, its advisory said. Mullvad offers a secure OpenVPN connection for its clients for a monthly fee. Stromberg said his Heartbleed test against OpenVPN was part of due diligence for his customer base.
As far as a fix goes, VPN providers must go a step beyond patching servers, revoking certs and reissuing new ones and manually send a certificate revocation list to users and browser makers so that they won’t be accepted going forward.
“If you do not do that, you will still be vulnerable to man-in-the-middle attacks if someone sets that up,” Stromberg said. “It would be easy to impersonate a server.”
Stromberg noted in an email to OpenVPN that the TLS-auth feature in the software marginally protects against Heartbleed to the extent that the HMAC key used to authenticate packets that are part of a TLS handshake is kept secret.
“This means that while a small business may benefit from using tls-auth because only the employees have access to the key, a public VPN service such as ours does not, because anyone who is a customer has access to the key.”
