5

I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of our members use that single username.

Yesterday while we were surfing the web (checking mails) using that VPN connection someone hacked into our mail account, fortunately he was a white-hat and he told us there is a problem in our VPN server.

So if the hacker could connect to the VPN using that single username, is it possible for him to sniff all VPN traffic? Or is it more likely that he hacked into our mail account using other ways? We are really confused because the only way we could think of is that hacker has a full control over our server.

Improve this question
5
  • VPN is encrypted so the possibility is low
    – Sudantha
    Jul 17, 2011 at 14:17
  • 1
    Hi sos00 welcome to the site. Given that you use a single username for multiple people and I suppose they all use the same password, it is quite likely that your security was breached through non-technical means. Do you use any additional authentication or just username and password? Is everyone using the same password?
    – this.josh
    Jul 18, 2011 at 7:09
  • 1
    hello @this.josh yes, everyone use the same username and password (i.e vpnuser) for connecting to the VPN. it's a user account which is only able to dial-in (it's not member of any group) so possibly the attacker is using this username and password too, but we don't know how he could sniff the whole network's traffic.
    – sos00
    Jul 18, 2011 at 12:21
  • 'only able to dial-in' How do you enforce this? And how do you authenticate remote modem connections?
    – this.josh
    Jul 18, 2011 at 19:29
  • @josh: i'm not very sure about enforcing that. i just went to Local Users and Groups and created a new user ( didn't add it to any Group). after that goes through account properties and in the Dial-in tab under Network Access Permission i chose "Allow Access".
    – sos00
    Jul 18, 2011 at 20:17

2 Answers 2

Reset to default
6

Between two endpoints of a VPN connection that uses a properly-negotiated secure algorithm, one cannot decipher the encrypted traffic. Some things that can keep that from working right (in order of likelyhood):

  • Your attacker got between you and your VPN or between your VPN and your destination allowing them access to the cleartext.
  • Your VPN system didn't authenticate the host on the other end. You setup a secure connection to your attacker.
  • Your VPN system is configured in an insane manner, possibly allowing very weak keys or just encapsulation with no encryption.
Improve this answer
2
  • Thanks, as i said i haven't configured Network Policy Server for the VPN service so i think it has configured in that insane manner as you mentioned. the only thing i did was selecting EAP & MS-CHAP v2 as Authentication Methods for the VPN server. but even if there isn't any encryption how attacker could listen to others traffic ? i tried Wireshark and Ettercap to recreate the situation but it wasn't successfull.
    – sos00
    Jul 18, 2011 at 20:12
  • Imagine a MITM-attack. Let's assume the attacker forges SSL certificates (ssl split). Would this be a possible way for the attacker to sniff your traffic, even if you are connected to a VPN? Or would the VPNs encryption even prevent an attacker from even knowing what sites you visit (or hide any other information) and therefore prevent the attacker from creating a "pseudo-secure" page where he could read out things like credentials?
    – Merc
    Apr 20 at 10:43
0

VPN is encrypted so the possibility is low

may be the attacker attacked the mail accounts by password cracking (bruteforce , rainbow attacks or social enginnering)

Attacker can detected there is a encrypted traffic . but attacker is impossible to read it , because the sender and receiver are authenticated using a key exchange algorithm so attacker cant stand in the middle and the stream is encrypted : cannot read the content

Improve this answer
5
  • no, he definitely hijacked the session id by using some sort of listening to the traffic. i know there is some encryption but first of all i want to know is there a possibility to listening to that encrypted traffic at all ?
    – sos00
    Jul 17, 2011 at 14:32
  • updated the answer
    – Sudantha
    Jul 17, 2011 at 14:38
  • thanks a lot. about monitoring encrypted data, how it is possible ? i mean does the vpn server broadcast the traffic to the whole virtual network ?
    – sos00
    Jul 17, 2011 at 16:19
  • no no i dnt think its a IP network host to host ! .. btw make sure that ur network is secure with a good tunneling protocol such as IPsec
    – Sudantha
    Jul 17, 2011 at 16:24
  • Thanks again, is the attacker able to use some kind of ARP poisoning attack on a Virtual Network to route traffic to his own machine ? Also as i said we are using a single user for all of our VPN clients. could it be a security risk ? we are sure that attacker did not get control of the server but it seems somehow he could listen to outgoing traffic
    – sos00
    Jul 17, 2011 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .