De-anonymization of a VPN provider users

 Hello guys,

I decided to take a look at my vpn provider to assess its security posture.

First i decided to check for network traffic going in the vpn.I started by proxying the application with wireshark.I saw the program was downloading an update via HTTP.

This means the application was vulnerable to MITM leading to evilgrade attack where an attacker could replace program with malicious update/code leading to code execution.The updates are not digitally signed!

After that i knew i could get some impactful bugs.maybe a remote or local vulnerability.

Local credentials disclosure

I found the program was disclosing login details in memory .This is same vulnerability that affected putty in CVE-2011-4607 and other programs such as teamviewer(https://www.exploit-db.com/exploits/40342) and mysql(https://www.exploit-db.com/exploits/40337).The program logged login details such as username.password and tokens ,also the ip address connected to original ip address and timestamps  in the memory in plaintext.For an attack an attacker needs physical access to the pc or have a previous access to the computer via a malware.The malware or attacker could launch a memory checking tool and upload to a remote server or a physical attacker could view the above  details.with the above details an attacker could log in to the vpn as the user or have ip addresses history of the user hence De-anonymizing him/her.

Local privilege escalations

I started to look for local privileges escalation and checked for paths and services started by the program for misconfigurations.I found some DLL hijacking vulnerabilities leading to escalation of privileges.

Information disclosure

Another bug was a text file logging user details  in a world-writable folder.The folder  can be accessed by any user on the Pc.unprivileged users can read and write to the folder.This meant an attacker with accesss to the computer could get the ip addresses history,login details(username,password,token),timestamps etc

A normal user could also tamper with the logs 

Okay you may be asking yourself what about a Remote Exploit against the VPN.That's a writeup for another day.I was lucky to get some ways to get users unmasked ip address by  visiting a website.

The bugs were reported to the vpn vendor and fix for the above vulnerabilities rolled out.