7 ms·

Can someone ELI5 how they identify VPN at the protocol level?

by Multrex 3y ago

vbezhenar 3y ago
DPI. Popular VPN protocols are easily identified by first connection packet signature.
- littlestymaar 3y ago
  Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)
  - bogantech 3y ago
    IDK but Wireshark has no problem identifying it so there must be something that gives it away
    - Aissen 3y ago
      They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63aa8638076ec81dc9482972e9/epan/dissectors/packet-wireguard.c#L1618-L1625 https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63... * Heuristics to detect the WireGuard protocol: * - The first byte must be one of the valid four messages. * - The total packet length depends on the message type, and is fixed for * three of them. The Data type has a minimum length however. * - The next three bytes are reserved and zero in the official protocol. * Cloudflare's implementation however uses this field for load balancing * purposes, so this condition is not checked here for most messages. * It is checked for data messages to avoid false positives.
  - Starmina 3y ago
    Not at all, WireGuard is secure, but very easily identifiable.
  - vbezhenar 3y ago
    https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ The initiator sends this message: msg = handshake_initiation { u8 message_type u8 reserved_zero[3] u32 sender_index u8 unencrypted_ephemeral[32] u8 encrypted_static[AEAD_LEN(32)] u8 encrypted_timestamp[AEAD_LEN(12)] u8 mac1[16] u8 mac2[16] } msg.message_type = 1 msg.reserved_zero = { 0, 0, 0 } Seems like this is trivially detected. Just watch for first UDP packet with 01-00-00-00 bytes in the payload.
  - fruitreunion1 3y ago
    No. https://www.wireguard.com/known-limitations/ https://www.wireguard.com/known-limitations/ >Deep Packet Inspection >WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however. >TCP Mode >WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.
inrussianow 3y ago
INAE, but I think they sniff the initial handshake the protocols have and then drop subsequent packets.
ytch 3y ago
For the case in China, they use statistics, entropy of packets (may not an accurate term) and other DPI-like methods[1], also HN discussions of it[2]: [1] https://gfw.report/publications/usenixsecurity23/en/ https://gfw.report/publications/usenixsecurity23/en/ [2] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485

Can someone ELI5 how they identify VPN at the protocol level?

vbezhenar 3y ago

DPI. Popular VPN protocols are easily identified by first connection packet signature.

littlestymaar 3y ago
Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)
- bogantech 3y ago
  IDK but Wireshark has no problem identifying it so there must be something that gives it away
  - Aissen 3y ago
    They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63aa8638076ec81dc9482972e9/epan/dissectors/packet-wireguard.c#L1618-L1625 https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63... * Heuristics to detect the WireGuard protocol: * - The first byte must be one of the valid four messages. * - The total packet length depends on the message type, and is fixed for * three of them. The Data type has a minimum length however. * - The next three bytes are reserved and zero in the official protocol. * Cloudflare's implementation however uses this field for load balancing * purposes, so this condition is not checked here for most messages. * It is checked for data messages to avoid false positives.
- Starmina 3y ago
  Not at all, WireGuard is secure, but very easily identifiable.
- vbezhenar 3y ago
  https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ The initiator sends this message: msg = handshake_initiation { u8 message_type u8 reserved_zero[3] u32 sender_index u8 unencrypted_ephemeral[32] u8 encrypted_static[AEAD_LEN(32)] u8 encrypted_timestamp[AEAD_LEN(12)] u8 mac1[16] u8 mac2[16] } msg.message_type = 1 msg.reserved_zero = { 0, 0, 0 } Seems like this is trivially detected. Just watch for first UDP packet with 01-00-00-00 bytes in the payload.
- fruitreunion1 3y ago
  No. https://www.wireguard.com/known-limitations/ https://www.wireguard.com/known-limitations/ >Deep Packet Inspection >WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however. >TCP Mode >WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.

inrussianow 3y ago

INAE, but I think they sniff the initial handshake the protocols have and then drop subsequent packets.

ytch 3y ago

For the case in China, they use statistics, entropy of packets (may not an accurate term) and other DPI-like methods[1], also HN discussions of it[2]: [1] https://gfw.report/publications/usenixsecurity23/en/ https://gfw.report/publications/usenixsecurity23/en/ [2] https://news.ycombinator.com/item?id=36531485 https://news.ycombinator.com/item?id=36531485