May 12, 2005 1:31 PM PDT

Flaw found in VPN crypto security

Related Stories

Citrix to acquire SSL VPN start-up

November 23, 2004

Remote access for small companies

July 16, 2004

Browser security takes off in VPNs

January 14, 2004
A flaw in a popular VPN technology could allow hackers to obtain a text version of encrypted communications with only "moderate effort," a tech security body has warned.

Britain's national emergency response team, the National Infrastructure Security Coordination Centre, issued a warning this week about the safety of virtual private networks that use IPsec encryption and tunneling to connect remote workers to corporate networks.

The flaw, which the NISCC rates as "high" risk, makes it possible for an attacker to intercept IP packets traveling between two IPsec devices. They could then modify the encapsulation security payload--a subprotocol that encrypts the data being transported. This could ultimately expose this data to an unauthorized third party.

On its Web site, NISCC stated: "By making careful modifications to selected portions of the payload of the outer packet, an attacker can effect controlled changes to the header of the inner (encrypted) packet?If these messages can be intercepted by an attacker, then plaintext data is revealed."

The NISCC includes a number of solutions to this issue in its advisory.

Dan Ilett of ZDNet UK reported from London.

8 comments

Join the conversation!
Add your comment (Log in or register)
Need a little more
Not much detail in this report - it implies that All IPsec is at risk despite the numerous implementations and protocols available. I find it hard to believe that this flaw affects all vendors.
So where is the real story?.
Posted by Marcus Westrup (415 comments )
Reply Link Flag
I Agree
Where's the beef?

This sounds like a potentially far-reaching issue. More details would be appreciated.
Posted by rdrrichards (24 comments )
Link Flag
The real story isn't as sensational
If you read the NISCC advisory, you'll see this only applies to ESP packets that don't have an accompanying integrity check such as MD5 or SHA-1. I haven't seen any IPsec device that doesn't make use of integrity checks, but there are probably poorly designed implementations out there that make this mistake.

I would say that if you see MD5 or SHA-1 in your IPsec policy then you have nothing to worry about.
Posted by (2 comments )
Link Flag
Need a little more
Not much detail in this report - it implies that All IPsec is at risk despite the numerous implementations and protocols available. I find it hard to believe that this flaw affects all vendors.
So where is the real story?.
Posted by Marcus Westrup (415 comments )
Reply Link Flag
I Agree
Where's the beef?

This sounds like a potentially far-reaching issue. More details would be appreciated.
Posted by rdrrichards (24 comments )
Link Flag
The real story isn't as sensational
If you read the NISCC advisory, you'll see this only applies to ESP packets that don't have an accompanying integrity check such as MD5 or SHA-1. I haven't seen any IPsec device that doesn't make use of integrity checks, but there are probably poorly designed implementations out there that make this mistake.

I would say that if you see MD5 or SHA-1 in your IPsec policy then you have nothing to worry about.
Posted by (2 comments )
Link Flag
no story
there is no story.
The substance of the warning is: "If you misconfigure your VPN, it might not work"

the real story is that CERT and NISCC have so little of relevance to do with themselves, that they are issuing garbage like this.

Probably what happened is that someone important (therefore too important to actually read the documentation) made a stupid mistake, put his entire organization at risk, and is now forcing CERT to issue a warning. There are perhaps three people like that: someone at Homeland insecurity, someone at MI5, or someone at CERT.
Posted by (3 comments )
Reply Link Flag
no story
there is no story.
The substance of the warning is: "If you misconfigure your VPN, it might not work"

the real story is that CERT and NISCC have so little of relevance to do with themselves, that they are issuing garbage like this.

Probably what happened is that someone important (therefore too important to actually read the documentation) made a stupid mistake, put his entire organization at risk, and is now forcing CERT to issue a warning. There are perhaps three people like that: someone at Homeland insecurity, someone at MI5, or someone at CERT.
Posted by (3 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

Inside CNET News

1-2 of 12

Scroll Left Scroll Right

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

Markets

Market news, charts, SEC filings, and more

Related quotes

Dow Jones Industrials (0.57%) 72.81 12,874.04
S&P 500 (0.68%) 9.13 1,351.77
NASDAQ (0.95%) 27.51 2,931.39
CNET TECH (0.84%) 17.13 2,049.14
  Symbol Lookup