Penetration Test Report (Leviathan): Leviathan Golden Frog Report

VyprVPN No Log Assessment
Final Report
Prepared for: Michael Douglass
Chief Scientist
Golden Frog
2500 Bee Cave Road
Building 1, Suite 400
Austin, TX 78746-6943
United States
11/9/2018
© 2018 Leviathan Security Group Incorporated.
All Rights Reserved. Disclaimer
This document contains information, which is No trademark, copyright, or patent licenses are
protected by copyright and pre-existing non- expressly or implicitly granted (herein) with this
disclosure agreement between Leviathan analysis, report, or white paper.
Security and the company identified as
All brand names and product names used in this
“P d F ” h g
document are trademarks, registered
No part of this document may be photocopied, trademarks, or trade names of their respective
reproduced, or translated to another language holders. Leviathan Security Group is not
without the prior written and documented associated with any other vendors or products
consent of Leviathan Security Group and the mentioned in this document.
y d f d “P d F ” h
page.
Version: Final Report with Retest Results
Prepared for: Golden Frog
Date: 11/9/2018
Prepared by: J V , Ry O’N , D C C w , and Mark Stribling
Confidentiality Notice
This document contains information confidential and proprietary to Leviathan Security Group and Golden
Frog. The information may not be used, disclosed or reproduced without the prior written authorization of
either party and those so authorized may only use the information for the purpose of evaluation
consistent with authorization. Reproduction of any section of this document must include this notice.
Table of Contents
Table of Contents ................................................................................................................................................................................. 3
Executive Summary .............................................................................................................................................................................. 4
Observations ................................................................................................................................................................................ 4
Recommendations ..................................................................................................................................................................... 4
Findings Index .............................................................................................................................................................................. 5
Log Finding Classification ................................................................................................................................................................. 6
Threat Assessment and Scoping .................................................................................................................................................... 7
Project Components and Descriptions .............................................................................................................................. 9
Observations & Analysis ................................................................................................................................................................. 11
Cruncher/Logs and Splunk .................................................................................................................................................. 11
VPN Termination ..................................................................................................................................................................... 13
DAPI .............................................................................................................................................................................................. 17
Control Panel API..................................................................................................................................................................... 19
RADIUS Proxy and Server ..................................................................................................................................................... 21
User Client Applications ........................................................................................................................................................ 23
Lease DB ...................................................................................................................................................................................... 25
Appendix A – Technical Services ................................................................................................................................................. 26
Appendix B – Risk and Advisory Services ................................................................................................................................ 27
Appendix C – Leviathan Project Team ...................................................................................................................................... 28
CONFIDENTIAL INFORMATION / LIMIT DISTRIBUTION 3
Executive Summary
Golden Frog engaged Leviathan Security Group in September 2018 to evaluate updates to its VyprVPN
product with the goal of providing “N L g” VPN u S f y, L h wed
the platform to ensure that no Personally-Identifiable Information (PII) about customers with respect to
their use of the service are logged by Golden Frog except as required for business operations.
Golden Frog seeks to reduce the exposure of their clients by providing VPN service with an explicit
guarantee that it does not log connection details. It designed the various clients to report information
about connections by default, but that connection data is anonymized and can be turned off by user
configuration. Connections are logged during authentication, but logs that could identify users are kept
only for a short time. By using open source or widely-used applications for server and client components,
they have reduced the risk of unintentionally adding a weakness into the software themselves.
Observations
The VPN clients produce no identifying logs w h u h u ’ There were a limited number of
identifying logs on the VPN server which appeared result from inadvertent configuration mistakes.
Specifically, we found that logs for the kill switch API contained user IP addresses.
We considered a wide range of attackers that might be interested in deanonymizing VPN users. The most
common ones would be an ISP attempting to learn about the browsing habits of a user, or content
producers seeking to restrict activity to a geographic region. The most powerful attackers would be nation
states that may wish to determine the source of a leak. While VPNs should not be considered an effective
defense against highly-sophisticated attackers, they can reduce those k ’ options from surreptitious
gathering of intelligence to issuing a writ to force a company to spy on their users.
We examined all components of the project according to the threat assessment described below. While
vigilance against logging is necessary to complete the f g “N L g”, w f h h
h d g f u g w k G d F g’ implementation. The project
revealed a limited number of issues that Golden Frog quickly fixed. As a result, it can provide VyprVPN
users with the assurance that the company is not logging their VPN activity.
Recommendations
Golden Frog worked to remediate all no-log-related findings concurrently with the assessment. Once it
had completed this, we performed a retest and verified that all of the fixes were effective.
In the long term, we recommend that Golden Frog continue to monitor their servers for regressions. This
can be done manually as part of maintenance or automatically by creating an alert that triggers on test
data being recorded in logs. Since Golden Frog already has test accounts, they could use these to grep
logs for IP, username, and