I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of our members use that single username.

Yesterday while we were surfing the web (checking mails) using that VPN connection someone hacked into our mail account, fortunately he was a white-hat and he told us there is a problem in our VPN server.

So if the hacker could connect to the VPN using that single username, is it possible for him to sniff all VPN traffic? Or is it more likely that he hacked into our mail account using other ways? We are really confused because the only way we could think of is that hacker has a full control over our server.

  • VPN is encrypted so the possibility is low – Sudantha Jul 17 '11 at 14:17
  • 1
    Hi sos00 welcome to the site. Given that you use a single username for multiple people and I suppose they all use the same password, it is quite likely that your security was breached through non-technical means. Do you use any additional authentication or just username and password? Is everyone using the same password? – this.josh Jul 18 '11 at 7:09
  • 1
    hello @this.josh yes, everyone use the same username and password (i.e vpnuser) for connecting to the VPN. it's a user account which is only able to dial-in (it's not member of any group) so possibly the attacker is using this username and password too, but we don't know how he could sniff the whole network's traffic. – sos00 Jul 18 '11 at 12:21
  • 'only able to dial-in' How do you enforce this? And how do you authenticate remote modem connections? – this.josh Jul 18 '11 at 19:29
  • @josh: i'm not very sure about enforcing that. i just went to Local Users and Groups and created a new user ( didn't add it to any Group). after that goes through account properties and in the Dial-in tab under Network Access Permission i chose "Allow Access". – sos00 Jul 18 '11 at 20:17

Between two endpoints of a VPN connection that uses a properly-negotiated secure algorithm, one cannot decipher the encrypted traffic. Some things that can keep that from working right (in order of likelyhood):

  • Your attacker got between you and your VPN or between your VPN and your destination allowing them access to the cleartext.
  • Your VPN system didn't authenticate the host on the other end. You setup a secure connection to your attacker.
  • Your VPN system is configured in an insane manner, possibly allowing very weak keys or just encapsulation with no encryption.
| improve this answer | |
  • Thanks, as i said i haven't configured Network Policy Server for the VPN service so i think it has configured in that insane manner as you mentioned. the only thing i did was selecting EAP & MS-CHAP v2 as Authentication Methods for the VPN server. but even if there isn't any encryption how attacker could listen to others traffic ? i tried Wireshark and Ettercap to recreate the situation but it wasn't successfull. – sos00 Jul 18 '11 at 20:12
  • Also, could you please explain the second scenario a little ? how is that possible ? – sos00 Jul 18 '11 at 20:16

VPN is encrypted so the possibility is low

may be the attacker attacked the mail accounts by password cracking (bruteforce , rainbow attacks or social enginnering)

Attacker can detected there is a encrypted traffic . but attacker is impossible to read it , because the sender and receiver are authenticated using a key exchange algorithm so attacker cant stand in the middle and the stream is encrypted : cannot read the content

| improve this answer | |
  • no, he definitely hijacked the session id by using some sort of listening to the traffic. i know there is some encryption but first of all i want to know is there a possibility to listening to that encrypted traffic at all ? – sos00 Jul 17 '11 at 14:32
  • updated the answer – Sudantha Jul 17 '11 at 14:38
  • thanks a lot. about monitoring encrypted data, how it is possible ? i mean does the vpn server broadcast the traffic to the whole virtual network ? – sos00 Jul 17 '11 at 16:19
  • no no i dnt think its a IP network host to host ! .. btw make sure that ur network is secure with a good tunneling protocol such as IPsec – Sudantha Jul 17 '11 at 16:24
  • Thanks again, is the attacker able to use some kind of ARP poisoning attack on a Virtual Network to route traffic to his own machine ? Also as i said we are using a single user for all of our VPN clients. could it be a security risk ? we are sure that attacker did not get control of the server but it seems somehow he could listen to outgoing traffic – sos00 Jul 17 '11 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.