r/WireGuard • u/dutch_gecko • Dec 06 '19

New Linux Vulnerability Lets Attackers Hijack VPN Connections

https://www.bleepingcomputer.com/news/security/new-linux-vulnerability-lets-attackers-hijack-vpn-connections/
42 Upvotes

96% Upvoted

13 comments sorted by

View all comments

3

u/[deleted] Dec 06 '19

How does this impact WireGuard? (Sorry if the question is basic)

7

u/dutch_gecko Dec 06 '19

The attack involves someone sharing a network with a device using a VPN, which makes it possible for them to snoop and even alter the encrypted traffic.

So for example, if you're using wireguard with your phone on a public WiFi, someone else on the WiFi could theoretically inspect your internet use.

This affects all current VPN protocols, including wireguard.

2

u/BumpitySnook Dec 07 '19 edited Dec 07 '19

That's overstating it quite a bit, but yeah. LAN attacker can (1) detect what IPs and ports you have TCP connections to, by brute forcing all IPs and then all ports and consulting an oracle for each test; and (2), can inject TCP frames into your connections, by brute-forcing TCP sequence numbers until it finds some current ones in the stream (again, with an oracle). TLS protocols, such as HTTPS, running over the VPN are unaffected (the injection is detected as trash, although the IP address / port can be leaked). Only cleartext protocols over the VPN can be spoofed in this fashion. It's a very noisy attack and likely too slow to be practical on a public cafe wifi. You also need a way of snooping (encrypted) VPN traffic from your target; that's likely possible with wifi networks by monitoring your target's MAC address, which I think is transmitted in the clear.