1

I'm not an expert in VPN, so I'm curious about how well does a router with installed vpn defend against an mitm attack. Since ARP Spoofing can decrypt https, I'm concerned if it's able to decrypt a vpn too.

Also will the hacker be able to DOS your internet connection?

Then, what if let's say one of the device using the vpn is compromised? Will the hacker be able to use it to hack the rest of your devices?

Improve this question
12
  • How can ARP spoofing help with decrypting of HTTPS? If it gets compromised it does not matter what you installed before or after. What kind of DOS you mean? That he will shut down the router remotely? If VPN is compromised it depends if you share keys with others. I assume you mean you have OpenVPN server on your router and you are connecting to it from the internet.
    – Fis
    May 31, 2017 at 13:49
  • @Fis ARP is layer 2, it's much lower level than https, so it's able to read it. How did you know I have a hacking problem? Are you the one hacking me? :)
    – Corbee
    May 31, 2017 at 13:51
  • It can read encrypted data. Nothing else. Sure, I am hacking the whole world ;) Btw. ARP is layer 3.
    – Fis
    May 31, 2017 at 13:53
  • @Fis when you're a victim of a serious hacking, you turn paranoid. Anyways, I have tried VPN, but for some reasons, when connected, the hacker stops my internet, I'm wondering if placing the VPN on the router fixes the issue, I use openwrt by the way.
    – Corbee
    May 31, 2017 at 13:55
  • What can you see in your netstat? Can you see some strange connections on the router? You'll probably see my IP there ;)
    – Fis
    May 31, 2017 at 13:56

1 Answer 1

Reset to default
3

I'm not an expert in VPN, so I'm curious about how well does a router with installed vpn defend against an mitm attack. Since ARP Spoofing can decrypt https, I'm concerned if it's able to decrypt a vpn too.

ARP spoofing cannot decrypt HTTPS traffic. HTTPS 'sits higher' in the network stack and therefore layer 2 cannot 'see into' the packet. It can though do things to the packet, such as change the physical machine address of whom sent it or where it is going. But it definitely cannot decrypt the packet

Also will the hacker be able to DOS your internet connection?

An attacker could cause a denial of service to any service sitting publically on the internet if they have enough bandwidth to overcome your ingress bandwidth. I do not see though that DOS is a concern within the context of your router being ARP spoofed.

Then, what if let's say one of the device using the vpn is compromised? Will the hacker be able to use it to hack the rest of your devices?

Yes - If the VPN is not segregated from the rest of the network via say a Firewall and the other hosts do not have suitable host based firewalls.

Improve this answer
16
  • but if that's the case why are there hacking programs like sslstrip? What does it do?
    – Corbee
    May 31, 2017 at 14:01
  • sslstrip is used to strip ssl from web requests. So the content returned to a client is a HTTP and not HTTPS. This allows the attacker to 'see into' the packets of data. This is totally not related to VPN and/or ARP spoofing
    – ISMSDEV
    May 31, 2017 at 14:03
  • I am not sure what ssl strip is, probably some MITM proxy. But you should be able to see the certificate is not valid and don't continue in connection in such case. Or if it is like @ISMSDEV said you should not open HTTP page if you expect HTTPS
    – Fis
    May 31, 2017 at 14:03
  • @Fis. It's a proxy that strips HTTPS and returns HTTP. Thus allowing the attacker to see the content. I suspect the OP has seen this as many ARP spoofing tools in Kali have this as a plugin. :)
    – ISMSDEV
    May 31, 2017 at 14:04
  • 1
    Seems like he is in your computer/phone, not in router or in front of it.
    – Fis
    May 31, 2017 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .