1

I'm not an expert in VPN, so I'm curious about how well does a router with installed vpn defend against an mitm attack. Since ARP Spoofing can decrypt https, I'm concerned if it's able to decrypt a vpn too.

Also will the hacker be able to DOS your internet connection?

Then, what if let's say one of the device using the vpn is compromised? Will the hacker be able to use it to hack the rest of your devices?

  • How can ARP spoofing help with decrypting of HTTPS? If it gets compromised it does not matter what you installed before or after. What kind of DOS you mean? That he will shut down the router remotely? If VPN is compromised it depends if you share keys with others. I assume you mean you have OpenVPN server on your router and you are connecting to it from the internet. – Fis May 31 '17 at 13:49
  • @Fis ARP is layer 2, it's much lower level than https, so it's able to read it. How did you know I have a hacking problem? Are you the one hacking me? :) – Corbee May 31 '17 at 13:51
  • It can read encrypted data. Nothing else. Sure, I am hacking the whole world ;) Btw. ARP is layer 3. – Fis May 31 '17 at 13:53
  • @Fis when you're a victim of a serious hacking, you turn paranoid. Anyways, I have tried VPN, but for some reasons, when connected, the hacker stops my internet, I'm wondering if placing the VPN on the router fixes the issue, I use openwrt by the way. – Corbee May 31 '17 at 13:55
  • What can you see in your netstat? Can you see some strange connections on the router? You'll probably see my IP there ;) – Fis May 31 '17 at 13:56
3

I'm not an expert in VPN, so I'm curious about how well does a router with installed vpn defend against an mitm attack. Since ARP Spoofing can decrypt https, I'm concerned if it's able to decrypt a vpn too.

ARP spoofing cannot decrypt HTTPS traffic. HTTPS 'sits higher' in the network stack and therefore layer 2 cannot 'see into' the packet. It can though do things to the packet, such as change the physical machine address of whom sent it or where it is going. But it definitely cannot decrypt the packet

Also will the hacker be able to DOS your internet connection?

An attacker could cause a denial of service to any service sitting publically on the internet if they have enough bandwidth to overcome your ingress bandwidth. I do not see though that DOS is a concern within the context of your router being ARP spoofed.

Then, what if let's say one of the device using the vpn is compromised? Will the hacker be able to use it to hack the rest of your devices?

Yes - If the VPN is not segregated from the rest of the network via say a Firewall and the other hosts do not have suitable host based firewalls.

  • but if that's the case why are there hacking programs like sslstrip? What does it do? – Corbee May 31 '17 at 14:01
  • sslstrip is used to strip ssl from web requests. So the content returned to a client is a HTTP and not HTTPS. This allows the attacker to 'see into' the packets of data. This is totally not related to VPN and/or ARP spoofing – ISMSDEV May 31 '17 at 14:03
  • I am not sure what ssl strip is, probably some MITM proxy. But you should be able to see the certificate is not valid and don't continue in connection in such case. Or if it is like @ISMSDEV said you should not open HTTP page if you expect HTTPS – Fis May 31 '17 at 14:03
  • @Fis. It's a proxy that strips HTTPS and returns HTTP. Thus allowing the attacker to see the content. I suspect the OP has seen this as many ARP spoofing tools in Kali have this as a plugin. :) – ISMSDEV May 31 '17 at 14:04
  • 1
    Seems like he is in your computer/phone, not in router or in front of it. – Fis May 31 '17 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.