[klapinat0r]

> What then struck me was the way he casually decided to hack a VPN

He's intentionally vague, but given he mentions two routers and two vpn systems, it's highly probable that he's referring to one of the two routers (which is embedded, and has firmware). Furthermore, he refers to a website[1] which predominately deals with routers.

> is it really so straightforward?

Routers, yes[2], VPN daemons, not as much.

[1]: http://www.devttys0.com/training/ - which can also contain a vpn daemon of course.

[2]: https://github.com/darkarnium/secpub/tree/master/Multivendor...