Problem
Research questions and friction points this paper is trying to address.
VPN
session manipulation
non-interference
connection tracking
adversarial attack
Invisible Adversaries: A Systematic Study of Session Manipulation Attacks on VPNs
🤖 AI Summary
This study uncovers non-interference security vulnerabilities in VPN servers stemming from shared resource abuse and insufficient session state validation, thereby challenging the long-standing assumption that users on the same server operate in isolation. Through network protocol analysis, session state modeling, and penetration testing, the work systematically identifies three classes of session manipulation attacks: denial-of-service, TCP connection hijacking, and DNS response injection. Empirical evaluation across five mainstream connection tracking frameworks and nine major commercial VPN providers reveals that all tested frameworks and eight of the nine providers are susceptible to at least one such vulnerability. These findings have led to the assignment of 19 CVE/CNVD identifiers and prompted vendor remediations, marking the first systematic demonstration of fundamental flaws in VPN session isolation mechanisms.
📝 Abstract
Virtual Private Networks (VPNs) are widely used for censorship evasion and traffic protection. VPN users expect to be provided with adequate security protection, and at the same time not be affected by other users connected to the same VPN server, which can be illustrated as the non-interference property. However, in this paper, we have identified several vulnerabilities that violate this property, specifically within the connection tracking frameworks of VPN servers, stemming from shared resource misuse and insufficient validation of session state transitions. We present three session manipulation attacks targeting TCP and UDP traffic tunneled through VPNs. The attacker who only connects to the same VPN server can launch denial-of-service attacks, hijack TCP connections of other clients, or inject forged DNS responses into their queries. We evaluate these attacks against five popular connection tracking frameworks across different OSes and nine major commercial VPN providers. Experimental results reveal that all frameworks and eight providers are vulnerable to at least one of the attacks. We have responsibly disclosed our findings with countermeasures, resulting in 19 assigned CVEs/CNVDs and acknowledgments from the communities and providers.
Innovation
Methods, ideas, or system contributions that make the work stand out.
session manipulation
VPN security
connection tracking
non-interference
adversarial co-tenancy
🔎 Similar Papers
No similar papers found.
