MITM VPN attack?

so i know how MITM ssl attacks work, and sinse VPN's use asyncronis key exchange just like ssl... would it be possible to to perform the same type of attack.

Fool the user into thinking you're the correct vpn server, and fool the real server into thinking your the correct user?

With the user using your public/private key, it would then be possible to decrypt his traffic and see the communication. Im more interested in decrypting the isakmp traffic instead of the ipsec. Although both should be possible.

I've talked it over with a few people, all think its possible, but im opening it up for public debate, any thoughts? And if this has been done before, can any one recomend a tool?

Yes it is possible though i dont know of any simple tools. I did a quick google search and found this
"Man-in-the-Middle" attack if clients do not verify the certificate of the server they are connecting to."
From http://openvpn.net/howto.html

I would think the biggest hang up for the attacker would be that most vpn servers that i have seen use an IP and not DNS. So you couldnt spoof them to connect to an attackers computer.

I may be off so please correct me but if one was to try to impliment this attack i think it would make the most sense to use two nics. Set one up with an ip of the vpn and have the other forward on the traffic. You would have to dos the vpn long enough to have the client connect to you then stop the dos so you could connect to it and forward to traffic. Seems like it would be very hard to pull off this way. Some one may have a better idea. While being fesable with my knowlage i dont see it being any where as easy as breaking ssl. - TheX1le

Thanks for the reply and the link.

Connecting to the direct IP could be re routed with an arpspoof (but that would require the attacker knowing the target prior to the initial vpn hand shake) so yeah, one point for you. However, in SSL MITM attacks, the attacker doesnt need to know the target server prior to the attack... they just listen for the ssl handshake and go from there. I propose the same sort of technique for VPN's and listen for isakmp traffic.



As for the link, thanks. Basically it shows how to enforce key verification, but only with that one product. :/. However, this MITM attack could be prevented with a pre-shared key installed on all the vpn clients/servers. This may be an administrative hassel, but if you have a small number of clients... may be worth looking into.

As for the two nics... you may or may not be right there... with MITM SSL you can do it with one nic. I would worry about the over head of doing two VPN's. Like technically it should work with one... but practically it may be better with two.

Ah i see what your saying. I see where i made my mistake and thank you for correcting me. I found the link a little interesting and helpfull to me but yes it is related to just one product. So lets see here one point for me for the arp spoof. However i lose the point For not needing to know the server. That would put me back at 0 and well say i get half a point for the 2 nic idea. That leaves me at .5 WOOT lol. Any ways this is an interesting topic i will be sure to watch to see if any one has any ideas.