Penetration Test Report (RadicallyOpenSecurity): 2023 Pentest Mullvad VPN v1.1

Penetration Test Report
Mullvad VPN AB
V 1.1
Amsterdam, August 7th, 2023
Public
Document Properties
Client Mullvad VPN AB
Title Penetration Test Report
Targets Wireguard VPN
OpenVPN
Version 1.1
Pentester Stefan Grönke
Authors Stefan Grönke, Marcus Bointon
Reviewed by Marcus Bointon
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 May 26th, 2023 Stefan Grönke Initial draft
0.2 June 5th, 2023 Marcus Bointon Review
1.0 June 8th, 2023 Marcus Bointon 1.0
0.4 July 7th, 2023 Stefan Grönke Re-test findings
0.5 July 12th, 2023 Marcus Bointon Re-test review
1.1 August 7th, 2023 Marcus Bointon 1.1
Contact
For more information about this document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Science Park 608
1098 XH Amsterdam
The Netherlands
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
Radically Open Security B.V. is registered at the trade register of the Dutch chamber of commerce under number 60628081.
Table of Contents
1 Executive Summary 5
1.1 Introduction 5
1.2 Scope of work 5
1.3 Project objectives 5
1.4 Timeline 5
1.5 Results In A Nutshell 5
1.6 Summary of Findings 6
1.6.1 Findings by Threat Level 8
1.6.2 Findings by Type 9
1.7 Summary of Recommendations 9
2 Methodology 11
2.1 Planning 11
2.2 Risk Classification 11
3 Reconnaissance and Fingerprinting 13
4 Findings 14
4.1 MLL-024 — Production multihop traffic on test system 14
4.2 MLL-008 — Home directory of monitor can be hijacked 17
4.3 MLL-009 — IPMItool allows persistence on otherwise memory-only servers 18
4.4 MLL-019 — LPE to root using systemd timers and insecure directory permissions 20
4.5 MLL-022 — Netfilter flaw allows LPE to root 22
4.6 MLL-031 — IPMI is configured in failover mode 23
4.7 MLL-045 — Administrator access to production machines 24
4.8 MLL-012 — Non-minimized Linux 25
4.9 MLL-033 — No microcode updates applied on servers 27
4.10 MLL-038 — AppArmor is unconfined for most exposed services 29
4.11 MLL-044 — No remote syslog and audit logging 30
4.12 MLL-003 — gpg-agent running as root reads config from an unprivileged account 31
4.13 MLL-007 — SSH daemon allows agent forwarding 33
4.14 MLL-013 — No usage of network namespaces or containers 34
4.15 MLL-014 — iptables SNAT does not specify outgoing interface 35
4.16 MLL-027 — Reverse path filter in loose mode has no effect due to default routes 36
4.17 MLL-029 — Missing binary hardening on tcp2udp and blocklist-service 37
4.18 MLL-030 — No pre-shared key on wg-internal interface 39
4.19 MLL-037 — DNS hijacking on VPN clients 40
4.20 MLL-039 — Non-specific API passwords for blocklist-service 42
4.21 MLL-043 — Blocklist-service is listening globally 43
4.22 MLL-047 — Sudo without password 44
4.23 MLL-021 — Shared snmp credentials across servers 45
4.24 MLL-018 — Slack API key shared across servers 46
4.25 MLL-016 — Telegraf password shared across servers 47
5 Non-Findings 49
5.1 NF-006 — Bind DNS server is up to date 49
5.2 NF-023 — Influxdb user is write-only 49
5.3 NF-025 — danted does not appear to write log files 49
5.4 NF-026 — Bind DNS server does not log queries 51
6 Future Work 53
7 Conclusion 54
Appendix 1 Testing team 55
Public
1 Executive Summary
1.1 Introduction
Between May 8, 2023 and May 26, 2023, Radically Open Security B.V. carried out a penetration test for Mullvad VPN
AB.
This report contains our findings as well as detailed explanations of exactly how ROS performed the penetration test.
1.2 Scope of work
The scope of the penetration test was limited to the following targets:
• Wireguard VPN
• OpenVPN
The scoped services are broken down as follows:
• Host assesment of VPN servers: 10 days
• Reporting/PM/Review: 3-4 days
• (Optional) Retest: 1-3 days
• Total effort: 14 - 17 days
1.3 Project objectives
ROS will perform a host assessment of two production-alike VPN relay servers with Mullvad in order to assess the
security of the WireGuard and OpenVPN relay servers and verify privacy objectives. To do so ROS will access two
deployed systems via SSH and guide Mullvad in attempting to find vulnerabilities, exploiting any such found to try and
gain further access and elevated privileges.
1.4 Timeline
The security audit took place between May 8, 2023 and May 26, 2023.
1.5 Results In A Nutshell
During this crystal-box penetration test we found 1 High, 6 Elevated, 4 Moderate, 10 Low and 4 Info-severity issues.
Executive Summary 5
ROS audited two production-alike VPN relays, which were supposed to be isolated from user traffic. However, we found
our WireGuard test server was listed in the production environment as a multihop server, which users have apparently
been using MLL-024 (page 14). Compromised administrators potentially have access to user traffic through root
access on production machines MLL-045 (page 24) without audit logging MLL-044 (page 30) or sudo password
MLL-047 (page 44). Even with audit logging enabled, multiple local privilege escalation vulnerabilities in Netfilter
MLL-022 (page 22) and misconfigured permissions on a systemd timer script MLL-019 (page 20) can be used to
become root without leaving traces. In this area we also found misconfigured home folder permissions, allowing arbitrary
system accounts to compromise another service account MLL-008 (page 17).
Misconfiguration in the IPMI interface can break isolation between VPN and management networks MLL-031 (page
23) when the IPMI interface is down. Interestingly, IPMI can be used on memory-only systems by adversaries to gain
persistence MLL-009 (page 18).
Linux can be further hardened, for instance by confirming AppArmor profiles MLL-038 (page 29), deploying
Microcode updates MLL-033 (page 27), minimizing the userspace MLL-012 (page 25), using a pre-shared key on
WireGuard interfaces MLL-030 (page 39), adding binary hardening to services MLL-029 (page 37), ensuring the
effectiveness of reverse-path filtering MLL-027 (page 36).
SSH agent forwarding should be disabled MLL-007 (page 33) to mitigate mistakes in administrator's SSH client
configuration.
Some services on VPN servers use shared credentials; we recommend using unique per-system credentials for
blocklist-service MLL-039 (page 42), SNMP MLL-021 (page 45), Slack notifications MLL-018 (page 46), and
Telegraf MLL-016 (page 47). It might be feasible to switch to SSL client certificate authentication.
Overall, we found that significant effort had been put into preserving VPN clients privacy. We appreciate the in-memory
OS approach and the absence of logging of user-related (meta)data, but recommend logging administrator activity
on production machines. Ideally administrators should not be able to access production systems, but instead boot
a server from a debug image with login capability which does not serve production traffic, so that admin access and
production traffic are never active at the same time. The two WireGuard and OpenVPN servers accessed by ROS
were appropriately hardened against client side attacks, so a majority of the findings and remarks refer to further OS
hardening, administrative access, and misconfigured permissions.
1.6 Summary of Findings
ID Type Description Threat level
MLL-024 Information Disclosure The VPN server used for testing processes multihop High
traffic for production VPN users.
MLL-008 Local Privilege The monitor user's home directory can be hijacked by Elevated
Escalation unprivileged system accounts.
MLL-009 Persistence Although VPN servers run from memory only, adversaries Elevated
with root access can persist access by manipulating IPMI
configuration and firmware.
6 Radically Open Security B.V.
Public
MLL-019 Local Privilege Improper filesystem permissions on /home/mad allows Elevated
Escalation other accounts to manipulate script files executed as root
through a periodic systemd timer.
MLL-022 Local Privilege VPN servers use a custom Linux Kernel 6.3.0, which Elevated
Escalation is vulnerable to CVE-2023-32233, a local privilege
escalation in netfilter.
MLL-031 Network