Penetration Test Report (Nettitude): ExpressVPN and Nettitude audit report

Penetration Testing
Results Summary
Prepared For: Express Technologies Ltd
Target: EXPRESSVPN WINDOWS APPLICATIONS
Author: LIM SHAO LOONG
Date: 2024-04-08
Version: 4.0
Confidential Security Data
Contents
1 Document Distribution List............................................................. 2
2 Revision History ............................................................................ 2
3 Introduction .................................................................................. 3
4 Analysis: ExpressVPN Windows Applications .................................... 4
4.1 Setup of Testing Environment ......................................................................... 4
4.2 Replication of the DNS Leak Vulnerability ......................................................... 6
4.3 Remediation of the DNS Leak Vulnerability....................................................... 9
4.4 IP Leak and Misconfigured VPN Profile ........................................................... 11
5 Overview of Findings ................................................................... 13
5.1 Finding Summary ......................................................................................... 13
5.2 ExpressVPN Windows Applications Summary.................................................. 13
Confidential S ecurity Data 1
1 Document Distribution List
Nettitude Name Title
Lim Shao Loong Security Consultant
Sojini Yap Account Manager
Joshua Chan Security Consultant
Iain Wallace Principal Security Consultant
ExpressVPN Name Title
Aaron Engel Chief Information Security Officer
Brian Schimacher Offensive Security Manager
2 Revision History
Version Issue Date Issued by Comments
0.1 03 March 2024 Lim Shao Loong Initial Draft
0.2 05 March 2024 Joshua Chan Quality Assurance
1.0 06 March 2024 Lim Shao Loong Final Version
1.1 21 March 2024 Lim Shao Loong Revised Draft
1.2 28 March 2024 Iain Wallace Quality Assurance
2.0 01 April 2024 Lim Shao Loong Final Version
3.0 05 April 2024 Lim Shao Loong Revised Final Version
4.0 08 April 2024 Lim Shao Loong Revised Final Version
Confidential S ecurity Data 2
3 Introduction
In March 2024, Express Technologies Ltd engaged Nettitude to conduct a penetration test on the
ExpressVPN Windows Applications. The primary objective of this assessment was to ensure that the DNS
leak vulnerability related to the split tunnelling feature found in versions v12.72.0.6 and v10.50.0.2 has
been remediated.
The following components were tested as part of the engagement:
Component Description
ExpressVPN for Windows v12.74.0.19 binaries DNS leak vulnerability related to split tunnelling
feature was observed in Windows v12.72.0.6 and
ExpressVPN for Windows v10.51.0.9 binaries
v10.50.0.2 binaries.
The scope of work is to ensure that the patched
binaries v12.74.0.19 and v10.51.0.9 have
effectively addressed the DNS leak vulnerability in
Windows 10 and 11.
During the period of engagement, the new binaries v12.74.0.19 and v10.51.0.9 were tested and deemed
to have effectively addressed the DNS leak vulnerability related to the split tunnelling feature. However, a
new vulnerability was observed in the v12.74.0.19 and v10.51.0.9 binaries, and has since been fixed. The
patched v10 application (v10.53) is available through a direct download link with split tunnelling
disabled, effectively resolving the issue. Additionally, the download option on the ExpressVPN website
for v10 is removed, thus decommissioning v10 of the Windows application.
This report will address how Nettitude was able to replicate the DNS leak vulnerability, how the new
binaries effectively addressed the issues, and finally, the new vulnerability that was observed during the
testing period and its remediation.
Confidential S ecurity Data 3
4 Analysis: ExpressVPN Windows
Applications
The ExpressVPN Windows binaries, versions v12.72.0.6 and v10.50.0.2, were found to be affected by a
DNS leak vulnerability related to the split tunnelling feature. The split tunnelling feature allows users to
selectively choose which applications go through the VPN route and which do not. However, two specific
conditions were identified that trigger the DNS leakage.
The two conditions that trigger the DNS leakage and affected specific versions are outlined below:
First Condition – Other VPN applications were installed on the Windows machine.
- v12.72.0.6
- v10.50.0.2
Second Condition – DNS Resolver Cached.
- v12.72.0.6
Nettitude then proceeded to replicate the DNS leak vulnerability using the vulnerable versions provided
by Express Technologies Ltd.
4.1 Setup of Testing Environment
The following table details the setup of the testing environment for this engagement:
Operating Systems Applications Installed ExpressVPN Binaries Tested
Windows 11 (Host Machine), Google Chrome, NordVPN, v12.72.0.6, v10.50.0.2,
Windows 11 (Virtual Machine) IPVanish, SurfShark v12.74.0.19, v10.51.0.9,
v12.75.0.18
Windows 10 (Host Machine), Google Chrome, NordVPN, v12.72.0.6, v10.50.0.2,
Windows 10 (Virtual Machine) IPVanish, SurfShark v12.74.0.19, v10.51.0.9,
v12.75.0.18
The default Internet Service Provider (ISP) used for this engagement is SingNet as shown in the
screenshot below:
Confidential S ecurity Data 4
Figure 1: Default ISP, DNS result from ipleak.net.
Confidential S ecurity Data 5
4.2 Replication of the DNS Leak Vulnerability
4.2.1 First Condition – Other VPN Applications Installed
The following screenshots demonstrate the first condition (Other VPN Applications Installed) to trigger
the DNS leak vulnerability:
Figure 2: Vulnerable v12.72.0.6 and other VPN applications installed with split tunnelling turned on.
The screenshot above provide details of the setup process for triggering a DNS leak. The ExpressVPN
application, along with other VPN applications (namely NordVPN, IPVanish, and Surfshark), were
installed on both Windows 10 and Windows 11 systems.
All the setups mentioned are configured with the same split tunnelling feature enabled with “Google
Chrome” selected as the application to route through the VPN.
The identical setup and testing environment were also applied to the vulnerable v10.50.0.2 version of the
ExpressVPN application. The presence of the other VPN applications listed in this report, when installed
on the same machine, consistently triggered the DNS leak issue without any additional actions required
beyond installation.
It’s noteworthy that, during testing, some systems experienced a DNS leak with only one of the other VPN
applications installed.
After connecting to the ExpressVPN application with split tunnelling enabled, a DNS leak occurred where
the service provider (SingNet) is still present in the DNS server list, as shown below:
Confidential S ecurity Data 6
Figure 3: DNS leak occurred.
4.2.2 Second Condition – DNS Resolver Cached
The following screenshots demonstrate the second condition (DNS Resolver Cached) to trigger the DNS
leak vulnerability:
Figure 4: Vulnerable v12.72.0.6 application installed with split tunnelling turned on.
The DNS leak based on the second condition was triggered by implementing the same setup as the first
condition, excluding other VPN applications that were installed.
Nettitude then proceeded to perform several DNS queries to ensure the DNS resolver was cached. This
can be achieved through dnsleaktest.com. Following this, connecting to a VPN profile that is
geographically distant from the current location resulted in the DNS leak illustrated below.
Confidential S ecurity Data 7
Figure 5: DNS leakage observed from ipleak.net results.
Confidential S ecurity Data 8
4.3 Remediation of the DNS Leak Vulnerability
During the testing period, the tested application versions v12.74.0.9 and v10.51.0.9 successfully resolved
the DNS leakage, as shown below:
4.3.1 First Condition – Other VPN Applications Installed (Remediated)
Figure 6: Patched v12.74.0.19 and other VPN applications installed with split tunnelling turned on.
Nettitude performed the same tests on the new binaries usi