Search papers, labs, and topics across Lattice.
The paper identifies vulnerabilities in VPN connection tracking frameworks that violate the non-interference property, allowing attackers on the same VPN server to manipulate other users' sessions. Three session manipulation attacks are presented: denial-of-service, TCP connection hijacking, and DNS response injection. Evaluation against five connection tracking frameworks and nine VPN providers revealed widespread vulnerability, leading to 19 CVEs/CNVDs.
VPNs, relied upon for secure and private browsing, are surprisingly susceptible to session manipulation attacks from co-located users on the same server.
Virtual Private Networks (VPNs) are widely used for censorship evasion and traffic protection. VPN users expect to be provided with adequate security protection, and at the same time not be affected by other users connected to the same VPN server, which can be illustrated as the non-interference property. However, in this paper, we have identified several vulnerabilities that violate this property, specifically within the connection tracking frameworks of VPN servers, stemming from shared resource misuse and insufficient validation of session state transitions. We present three session manipulation attacks targeting TCP and UDP traffic tunneled through VPNs. The attacker who only connects to the same VPN server can launch denial-of-service attacks, hijack TCP connections of other clients, or inject forged DNS responses into their queries. We evaluate these attacks against five popular connection tracking frameworks across different OSes and nine major commercial VPN providers. Experimental results reveal that all frameworks and eight providers are vulnerable to at least one of the attacks. We have responsibly disclosed our findings with countermeasures, resulting in 19 assigned CVEs/CNVDs and acknowledgments from the communities and providers.
Tsinghua AI