Successful private key extraction from OpenVPN using Heartbleed

[kfreds]

Hi HN,

We have successfully extracted private key material multiple times from an OpenVPN server by exploiting the Heartbleed Bug. The material we found was sufficient for us to recreate the private key and impersonate the server.

As you may know, OpenVPN has an SSL/TLS mode where certificates are used for authentication. OpenVPN multiplexes the SSL/TLS session used for authentication and key exchange with the actual encrypted tunnel data stream. The default TLS library for OpenVPN is OpenSSL. Since OpenVPN uses the OpenSSL library but merely passes through the TLS traffic to OpenSSL, this means that OpenVPN is exploitable using Heartbleed, in theory. However, until now there hasn't been any solid evidence that private key material can be extracted from OpenVPN just like it has from some web servers.

This was the server setup we used: Ubuntu 12.04 (VM using KVM) OpenVPN 2.2.1 OpenSSL 1.0.1-4ubuntu5.11

Our exploit is decently weaponized, and while the code is an abomination that even Eris would be embarrassed to present, we believe it may severely impact those who have not already upgraded. Therefore, we will not be publishing the code. Nevertheless, you should assume that other teams with more nefarious purposes have already created weaponized exploits for OpenVPN. Just to be clear, we don't intend to use this exploit ourselves. We merely developed it to examine the practical impact on OpenVPN as part of our incident investigation.

To our knowledge there is currently one published proof of concept script that checks an OpenVPN server's vulnerability to Heartbleed.

Private questions that are not requests for the exploit can be emailed to stromberg@insto.org or admin@mullvad.net (PGP: 0x2C62E8AE).

Best regards,

Fredrik Strömberg, Co-founder of Mullvad

(edit: Formatting, because I'm a HN noob.) (edit[?]: Giving up on the formatting.)

[claudius]

Apologies for the possibly stupid question: Did your OpenVPN server use TLS Authentication (tls-auth option) and, if so, did the attacker have access to that key?

What I have read so far seems to imply that OpenVPN is vulnerable, but only if not used with tls-auth or if the attacker has access to the tls-auth key (as is the case for e.g. clients).

[kfreds → claudius]

No, our target server did not use tls-auth because it would only have added complexity and no valuable information. The threat model for tls-auth is pretty straightforward.

You're correct in your second paragraph. I'll quote James Yonan and myself from last Monday:

Using the tls-auth option should protect against this vulnerability (assuming that your tls-auth key is not known to the attacker).

tls-auth is irrelevant if the attacker knows the key, which is the case for consumer VPN services like ours.

[claudius → kfreds]

Thank you very much for your reply! Of course it is irrelevant if the attacker knows the key, but that naturally depends on the threat model under consideration and your OP wasn’t too clear on that, hence my question :)

Thanks again!

[kfreds → claudius]

No problem, I only added the quotes for more clarity. I'm glad I could help :)

[jlgaddis → kfreds]

> Using the tls-auth option should protect against this vulnerability (assuming that your tls-auth key is not known to the attacker).

Thank you for clarifying this.

[avree]

Interesting. If true, this seems to contradict the statement released here: http://docs.openvpn.net/important-security-notice-regarding-...

Have you contacted OpenVPN directly?

[Wilya → avree]

Note that this statement is about OpenVPN Access Server, the commercial distribution of OpenVPN.

There is a bit more info in the "community" wiki [0]. It seems the key point is that TLS-auth would already mitigate the vulnerability. TLS-auth is on by default in OpenVPN Access Server, but for the vanilla openvpn, you have to configure it yourself.

And, as noted in the community statement, the TLS-auth is a single global pre-shared key. It could leak a bit more easily than personal certificates.

[0] https://community.openvpn.net/openvpn/wiki/heartbleed

[mrsaint → Wilya]

Well, TLS-auth should be used _on top_ of a PKI. It is a HMAC key that an attacker would need to know before he'd even be able to initiate a TLS handshake.

Thus, if you have used it in your OpenVPN setup, and if you know that the few users who have access to your VPN wouldn't have heartbleed-attacked you, then yes, you could assume that your private key has been safe from heartbleed despite an exploitable OpenSSL library.

[kfreds → avree]

I published on the openvpn-users mailing list before HN. I'll also be contacting them directly with technical details.

[jareds]

As someone who runs a personal OpenVPN server am I correct in assuming that I am not vulnerable to this as long as I have updated my OpenSSL library’s through the standard Linux package managers to a recent version that has fixed the Heartbleed bug?

[jamesbritt → jareds]

Are you sure that OpenVPN is not using it's own bundled openssl lib? I believe that was the case with OpenVPN_AS.

[kyllo → jamesbritt]

That was definitely the case with openvpn-as. I updated my openssl package but my VPS was still testing vulnerable until I updated openvpn-as.

[syzzer → jareds]

You should do that for all your vulnerable peers (i.e. clients too), and restart the daemon to make it load the updated library. Then generate new keys for all of them.

While there are vulnerable clients out there, you should consider your (vpn) network compromised.

[dserodio → jareds]

You should regenerate the keys after updating because they might've been exposed.

[higherpurpose]

I recently learned that SigmaVPN uses NaCl on Android, if anyone needs it.

https://play.google.com/store/apps/details?id=com.frozenrive...

It seems based on QuickTun, which is where the NaCl implementation comes from:

http://wiki.ucis.nl/QuickTun

[zx2c4 → higherpurpose]

This looks super cool. Submitted it in hopes of hearing more discussion on it. https://news.ycombinator.com/item?id=7599091 What's its security track record? Have you ever used this? The idea looks nice.

[droopybuns]

Have you considered submitting the attack to hacker one?

https://hackerone.com/internet

[kfreds → droopybuns]

No, I didn't think of any rewards. Thanks for the link though.

[droopybuns → kfreds]

If you do, and if you get an award, plz, for the love of security, donate the winnings to the openssl project instead of something mindless like the freedom of the press foundation.

[tinco → droopybuns]

Please don't donate any winnings, buy yourselves something nice. There's plenty big rich companies out there that should be running OpenSSL.

[tatref]

I have read that the client version of OpenVPN, which is also vulnerable to heartbleed, should be upgraded, as well as the server.

I wonder what could be a possible exploitation on the client side? Obviously, one can not send heartbeat packets to grab the secret key!