OpenVPN Is Open to VPN Fingerprinting

[tamimio]

I remember years ago someone made a site that detects if you are using a vpn based on some packets latency, and it was pretty accurate! Unfortunately, I don’t know what’s the website now.

[madars]

Might be http://witch.valdikss.org.ru/ , e.g., using number of flows and MTU (and maybe other techniques)

[fastily]

Maybe it was doileak.com? It’s now at https://www.top10vpn.com/tools/do-i-leak/

[guardiangod]

All those firewalls with Application Control IPS (Checkpoint, Palo Alto Network, Fortinet etc.) can already block OpenVPN connections, so this is no surprise that you can fingerprint them.

[nickburns]

you have the cart before the horse here. modern IPS uses, and has been using, more or less the same methodology the researchers mention in their abstract (full disclosure: i read no further): "[. . .] fingerprints based on protocol features such as byte pattern, packet size, and server response."

this technique has been around for a very long time and is no way novel. applying it to OpenVPN traffic specifically isn't either.

[lilsoso]

They can determine a connection to their network is through an OpenVPN server even if that server has a clean/normal IP address? Is there some otherwise basic tell that the host is running a VPN server? Could Palo Alto Network also identify say a different VPN server, such as Wireguard?

[riedel]

I guess the great firewall of china is a good benchmark too. It also scales quite good I guess.

[dfawcus]

How do these fingerprinting schemes work when the handshake protocol is not merely obfuscated, but actually encrypted?

i.e. if one uses the tls-crypt option?

As I understand it, that encrypts the handshake protocol such that simple data value matching will not work, and one would have to either use length and/or timing matches.

[gruez]

They can do what the gfw does and block any encrypted traffic that it doesn't recognize.

https://www.usenix.org/conference/usenixsecurity23/presentat...

[clwg]

This was the case over a decade ago as well, at the time obfsproxy[0] was one of the more reliable methods for establishing and maintaining openvpn connections in the more censorship heavy countries.

[0]https://blog.torproject.org/obfsproxy-next-step-censorship-a...

[codecutter]

I have a basic question somewhat related to this topic. When I am using Mullvad VPN, many websites block access. (E.g. Lowe's or Michaels.com etc). They force me to disable VPN and I don't like it.

My question is how do they detect that I am using a VPN and is there any workaround to access their site when I continue using VPN?

[teddanson2]

I believe the websites subscribe to a universal list of IP-adresses that are associated with major VPN-providers, and some entity maintains that.

You might be able to get around this by paying a provider like ProtonVPN extra for a static IP outside of the known range associated with ProtonVPN

[niceice]

So what's the good VPN?

[Timber-6539]

Any provider with shadowsocks configs. Or if not, if you have hardware lying around you could host a tunnel with gluetun.

[some_furry]

WireGuard

[thwarted]

This required research and publication on arxiv? OpenVPN is meant for access control to/between private networks, not for skirting public access controls put in place on your immediate, local upstream. The default config even encourages the use of the defined ports.

[dc-programmer]

It seems like other VPN vendors are slapping obfuscation on top of OpenVPN and advertising their service as unobservable. This paper contests that claim

[grubbs]

Default config with port 1194 is super common with "anonymous" VPN providers. It can very well be fingerprinted. But I hope the data in transit would be secure. Maybe not from NSA.

[nimbius]

correct. it sorta depends on what OpenVPNs goals are...

the boilerplate of the corporate face insists its for your businesses and their connectivity, so you could argue that confidentiality doesnt really include clandestine or obfuscated traffic presence at all.

However, you could also argue for OpenVPN (and several others) that as a security tool they should at least consider Goguen and Meseguer type noninterference as a conformant operation model by reducing the awareness of the traffic.

[gsich]

>not for skirting public access controls put in place on your immediate, local

Of course it's also meant for that.

[mianos]

A simple search "OpenVPN traffic detection" leads you to many pages on how this is not a thing OpenVPN tries to do and how to detect it. This whole paper is no more notable than a stack overflow question and answer, maybe less than something on quora.

[mianos]

here is one of many for those that seem to be voting me down: https://github.com/corelight/zeek-spicy-openvpn

I can't say this would be much more of a weekend project with spicy.

[jerhewet]

Jesus wept.

https://www.doileak.com/classic.html

[LegitShady]

this site says I have third party cookies enabled when firefox says I do not.

[iLoveOncall]

Fingerprinting? This is just clickbait. Identifying that the murder weapon was a knife isn't remotely the same as getting the fingerprint of the killer.

[riehwvfbk]

Context matters. In this case "fingerprinting" refers to fingerprinting of the protocol by a DPI system, and the problem the author is concerned with is the ability to use a VPN at all.

[JamesSwift]

Fingerprinting doesnt mean "uniquely identified an individual", it just means "uniquely identifies some aspect of the target". You could fingerprint 'firefox' amongst all browsers, or in this case they are fingerprinting OpenVPN amongst all traffic.

[rileymat2]

The term fingerprinting is in really common usage for this, “browser fingerprinting”

[sfmike]

it is. what if we know that only one person had said knife and then this "fingerprint" would be 100% empirical support. So yes sometimes just noting a VPN was used with said foreknowledge is enough to correlate and prove something.