VPN | Everything you must to know about Virtual Private Network

VPN stands for virtual private network or private communication network, Which is the most secure 🔐 ,method of connecting a computer to a private network .

with the help of public network, Such as the internet. It create a virtual tunnel through which the data travels from one computer to the other over the internet. Due to this , an attacker gets the way to use the remote client to relay attacks through the VPN tunnel.

In this blog you will learn about the following vulnerabilities of VPN.

∆ Insecure storage of authentication credentials by VPN client

∆ VPN fingerprinting

∆ Username enumeration vulnerabilities

∆ Ofline password 🔑 cracking

∆ Lack of account lockout

∆ Denial of service (DOS) attacks

∆ Configuration vulnerabilities of VPN

Insecure Storage of Authentication Credentials by VPN Clients

VPN client program store some or all of the authentication credentials, such as username and password, to identify and authenticate a user on the network. Although this setting makes the VPN easier to use ,it also introduce security risks. especially if the credentials are not well protected. The common client issues that have been seen in VPN are as follows:

• Storing the username unencrypted in a file or registry

• Storing the password in a scrambled form

• Storing the plain-text password in memory

• Storing file permissions as credentials

VPN Fingerprinting

There are various methods, such as User Datagram Protocol (UDP) back-off fingerprinting and vender 🆔 identity Fingerprinting, through which VPN server can be fingerprinted. This gives the useful information to potential attackers.

Username Enumeration Vulnerabilities

The most basic security requirement of a username/password authentication scheme is that the incorrect login information should not reveal the information about incorrect credentials (username or password) because this would allow an attacker to conclude whether a given username is valid or not. In VPN if user credentials are incorrect , it will inform the user ( attacker) whether the entered username is valid or not.

The three common faults that are found in the way the VPN server respond to the user are as follows:

• Some VPN server only respond to the client which has the valid username

• Some VPN server respond with a notification message, such as no-proposal chosen, if the username is incorrect

• Some VPN respond to both valid and invalid username, but in the situation , the invalid username hash payload is calculated using a null password, and it is difficult for the client to determine this.

Offline Password cracking

In VPN, an attacker can use the valid username with the internet key Exchange (IKE) aggressive mode to obtain a hase form the VPN server . After obtaining the hash, the attacker can use it to crack the associative password. This method of obtaining password is known as offline password cracking.

Lack of Account Lockout

When there are some instances of incorrect login attempt , an OS usually locks the account . However, serveral VPN implementation do not support this and allow an unlimited number of login attempts.

Denial of Service Attacks

Dos refers to the attack in which an attacker prevent the intended user from accessing the resources. There are two type of DoS vulnerabilities that have been observed on VPN server.

•Malware packet DoS

•Resource exhaustion DoS

Firewall :-how-to-secure-your-computer