Agent kugg on the Security of PPTP

Written by maloki on June 16th, 2010

Start: 15:37
What: Agent Kugg talks about the security of PPTP
Many larger VPN companies use PPTP for securing their customers. Kugg will talk about PPTP and show some de-anonymisation weaknesses for different setups. These techniques are actually used by government and private agencies to identify individuals using VPN.
Watch it: On bambuser

Don’t miss Hacknight!

Poptop and misconfigurations
The misconfigurations cause you to be not as anonymous as you think you are.

What is a VPN service?
It’s a virtual private network. It creates a local interface on your
What is a proxy?
It’s a relay of a request.

Errors:
You need a proxy for every thing. FTP, Gopher, SOCKS host.
It can be easy to fuck up here. It is often used as a deanonymisation

Flash don’t care, about your proxy. It will work with your real IP.
WSword, if you have a link in or to a document, it will reveal your IP.
Quicktime as well.
These does not respect your proxy settings.

Check www.decloak.net for information about how you’ve failed in your protection.
Proxy-Authenticate, for TOR-nods and such. Gmail, has Flash objects to figure out your real IP.

Velcme to the virtual private network! Everyone in the virtual network are on the same network. Which is a problem. You are exposing your entire harddrive, domain and mac adress.
nbtscan -m .t2000 -qv -s/
When scanning the network we find alot of information about the connected machines. Through this search, ones a day, you can find patterns, and start following the information you get.
It’s bad that they will get exposed. The people who are not exposed are the ones who are not showed in the list, but they are still pointed out.

On Bittorrent Anti Piratbyrån is found to have used Ipv6 to detect your real IP.

    PPTP Creates VPNetworks
    If Clients are not seperate they will expose each other
    IPv6 and pptp don’t match turn ipv6 off?
    Ms windows firewalls are stupid
    The known authentication mechanisms for pptp authentication are to weak. (EAP-TLS works if there are a public key exhange)
    Web browsers are dangers and hard to harden

Endusers needs help!
We need to detect flaws and expose them, and fix them. Make up new services.
Try and support OpenVPN
Teach SSH and share
Never leave a darknet

These are good systems, they just need to grow and be nurished and formed into something better.

Don’t miss Hacknight!

 

5 Comments so far ↓

  1. Stefan says:

    Gamla nyheter…
    Bruce Schneier har analyserat pptp, se mer på:

    http://www.schneier.com/pptp.html

  2. maloki says:

    Vet inte riktigt om jag påstod att det var nya nyheter ;) Utan att det var vad som pratades om på föreläsningen. :)
    Det är fortfarande något som inte är särskilt välspridd information, vilket är lite synd.
    Det är något folk som använder det bör få veta om. :)

  3. Stefan says:

    Sant, det är alltid bra att kunskap får spridning. Särskilt som pptp är det absolut vanligaste vpn-protokollet. Det fungerande openvpn brukar kosta extra om det ens finns att tillgå hos de flesta operatörer.

    Egentligen ville jag bara ge länken till Schneier för de som vill veta lite mer. Tack för att du tar upp ämnet!

  4. maloki says:

    Det är jättebra! Och egentligen var det ju inte jag som tog upp det, utan föreläsaren ;)

  5. Jocke says:

    Jag använder mig av http://www.pptpvpn.org dom kör pptp och rekommenderar att stänga av ipv6.

Leave a Comment





1 Trackbacks / Pingbacks

  1. Tweets that mention Marie till Riksdagen » Blog Archive » Agent kugg on the Security of PPTP -- Topsy.com