Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it really secure to connect to a (well-secured) VPN server over an unencrypted WLAN connection (or maybe a hotel Ethernet)?

I know, that there have been questions like this - but

  • I'm not asking if people can read/fake the encrypted contents of the VPN connection.
  • I'm not asking if the traffic of all my applications will be routed through the VPN.

What I'm worried about are more low level attacks. Is it reasonable to assume (and these are really just a wild guesses) for example,

  • that a fake WLAN access point could send specially crafted WLAN packages that would result e.g. in a buffer overflow on my WLAN adapter, which could be used to break into my system?
  • that somebody on the same LAN could send low level (ICMP, ARP, ...) packages that could exploit a security vulnerability of the kernel?

Additionally, I'm worried about a possible small time window after the insecure WLAN is established, but before VPN is up and running.

Things like these...

share|improve this question
1  
Unfortunately not even avoiding Microsoft fixes all the problems. The process for protecting against OS / device driver vulnerabilities is no different when using a VPN / public access than when on a private LAN. VPNs only address confidentiality and integrity - not availability. –  symcbean Aug 24 '12 at 11:38

2 Answers 2

up vote 1 down vote accepted

Based on your answers, comments, and my general basic understanding of the topic, I'll try to add my own answer here (Note: More answers and comments are very welcome - correct me especially, if my assumptions are wrong.)

@symcbean puts it in a nutshell:

VPNs only address confidentiality and integrity - not availability.

Availability can either be compromised by disrupting the network: WiFi jamming, flooding the LAN, faking IP or MAC addresses to e.g.

  • redirect to a different DNS (which doesn't impact confidentiality/integrity, if the VPN is fully set up, but it can impact availability before it's set up)
  • redirect to a different gateway (still doesn't impact confidentiality/integrity, but does impact availability)
  • ...

But what's more important: "Availability" of the VPN can be compromised by hacking your laptop on a low level - and many sets of attacks that you're exposed to when you connect to an unprotected network will still work when you tunnel through the unprotected network with VPN. And of course, once you're hacked, availability won't be the only problem...

It's not entirely clear, how likely these attacks are (and this would be a very interesting question!), but the thing that worries me most, is that this topic is never ever mentioned by administrators when they give out VPN access. Generally, an attitude of "it's okay to connect to the most unreliable and dangerous networks in the world - as long as you're using a secure VPN setup, you're safe" has evolved, and it's hard to convince anybody, that security of the VPN is not the only concern!

share|improve this answer

This is such a weird question. Without trying to address the questions you aren't asking.

Kernel. You are worried about a Kernel Vulnerability? That is highly unlikely but possible if you have an old and vulnerable kernel or if someone drops a 0day on you.

Same LAN attacks Someone on the same LAN could attack you and exploit a security vulnerability in your kernel if you have one. The chances of that happening are also small.

The low level attacks are fear are pretty non-existent. The biggest issue is that you are on a non-secure WLAN. Just being on a non-secure WLAN doesn't mean you are opening yourself up to a whole new set of attacks, but if you have an insecure non-patched computer you would be pretty easy to attack if a hacker connected to the WLAN.

I think you should also read up on your networking stack. ARP is super important and is a trusting protocol but unless there is a 0day it will not let someone remotely execute code on your machine

share|improve this answer
1  
Kernel vulnerabilities aren't uncommon. I can count 3 off the top of my head that I've tried first hand in the last 9 months. Granted they were local privesc, but look at the kernels used in iPhones and Android. Kernel remote code execution vulnerabilities aplenty! Plus there might be security holes in the wifi drivers. Or iptables. Or OpenSSH. Or OpenSSL. –  Polynomial Aug 23 '12 at 19:46
    
@Polynomial: Plus, on a public WLAN/hotel LAN, anybody can probe for vulnerabilities all day long, anonymously, with high frequency, without being thwarted by an IDS, ... –  Chris Lercher Aug 23 '12 at 20:22
    
I agree that if he is vulnerable and out of date he is at huge risk of being compromised on such a network, but I disagree with the risk (assuming he is on a up to date laptop or something...which excludes any mobile platform. Those things are a long way to from being secure. Maybe I am making too many assumptions). If he keeps his box up to date there is not a huge chance of being compromised... –  Rell3oT Aug 23 '12 at 20:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.