[Born-IT] ProtonVPN und NordVPN mit Privilege Escalation-Bug

Shodan · 16 Sep. 2018

Arbitrary Code Execution by config file ist fail. Aber wenn ein Angreifer ohne Adminrechte die Konfigurationsdateien des VPN Clients austauschen kann, ist sowieso etwas falsch.

Was haben die Hersteller da gepatched?
"Nun haben die Entwickler der VPN-Lösungen den Weg gewählt, dass ein Standard-Nutzer die Konfigurationsdateien gar nicht verändern kann." ~ Heise

Der Sinn gebrandeter proprietärer VPN clients erschließt sich mir aber sowieso nicht.

ProtonVPN desktop and mobile applications come with a built-in Kill Switch feature which will block all network connections in the event that the connection with the VPN server is lost. This prevents a VPN server disconnect from inadvertently compromising your privacy by revealing your true IP address.

Achso nette Features! Wie ist dieser Killswitch denn unter Linux implementiert?

Quelle: https://github.com/ProtonVPN/protonvpn-cli/blob/master/protonvpn-cli.sh#L675 (MIT License)
[src=bash]function killswitch() {
if [[ -f "$(get_protonvpn_cli_home)/.disable_killswitch" ]]; then
return
fi

if [[ $1 == "backup_rules" ]]; then
if [[ $(detect_platform_type) == "Linux" ]]; then
iptables-save > "$(get_protonvpn_cli_home)/.iptables.save"
elif [[ $(detect_platform_type) == "MacOS" ]]; then
# Todo: logic
false
fi
fi

if [[ $1 == "enable" ]]; then
if [[ $(detect_platform_type) == "Linux" ]]; then
vpn_port=$(get_openvpn_config_info | cut -d "@" -f2)
vpn_type=$(get_openvpn_config_info | cut -d "@" -f3)
vpn_device_name=$(get_openvpn_config_info | cut -d "@" -f4)
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A OUTPUT -o "$vpn_device_name" -j ACCEPT
iptables -A INPUT -i "$vpn_device_name" -j ACCEPT
iptables -A INPUT -i "$vpn_device_name" -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o "$vpn_device_name" -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p "$vpn_type" -m "$vpn_type" --dport "$vpn_port" -j ACCEPT
iptables -A INPUT -p "$vpn_type" -m "$vpn_type" --sport "$vpn_port" -j ACCEPT

elif [[ $(detect_platform_type) == "MacOS" ]]; then
# Todo: logic
false
fi
fi

if [[ $1 == "disable" ]]; then
if [[ $(detect_platform_type) == "Linux" ]]; then
iptables -F
iptables-restore < "$(get_protonvpn_cli_home)/.iptables.save"
elif [[ $(detect_platform_type) == "MacOS" ]]; then
# Todo: logic
false
fi
fi
}[/src]

Zeile 20, Zeile 26 .. what could possibly go wrong

Srsly i'm baffled, i must be reading this wrong?! Please explain #26

[Born-IT] ProtonVPN und NordVPN mit Privilege Escalation-Bug

Shodan

runs on biochips