mailing list archives
EarthVPN certificate configuration vulnerabilities
From: y6whynrzab () snkmail com
Date: Tue, 17 Sep 2013 00:35:09 +0000
EarthVPN (www.earthvpn.com) is a VPN service provider which claims "When connected, your data will be secured and
encrypted, keeping all your personal details private. EarthVPN will make sure that your online presence cannot be
intercepted, monitored and recorded by your internet service provider, company, school or government."
Their server configuration and suggested openvpn setup guide contains a number of vulnerabilities.
- The provided CA certificate earthvpn.crt is actually a public certificate authority ("GlobalSign Root CA"). This
means that anybody can register for a valid SSL certificate from GlobalSign.
- the setup guide did not advise to enable the "certificate hostname check" (under "authentication/encryption"). This
means that a certificate issued by GlobalSign to, say, fbi.gov will pass certificate validation, and can result in an
active man-in-the-middle attack that could eavesdrop on all traffic.
- They appear to be using the same certificate ("*.earthvpn.com") and keys on all servers that I've tried to connect
to. This means that compromise of any one of these servers would allow the theft of private keys that can be used to
m-i-t-m any other server. Put another way, a Russian dissident might want to connect to their UK servers to avoid
interception of his traffic. But the Russian government could compel the datacentre in Russia hosting their server to
reveal its keys. And it can use these keys to intercept and monitor the traffic to the UK server (or other servers).
EarthVPN has been contacted about these concerns, and insists that "it is not possible to do mitm attack without
knowing username and password of the clients as authentication will not be succeeded."
- EarthVPN certificate configuration vulnerabilities y6whynrzab (Sep 17)