Shuttling Through Secret Pipes: Unveiling Vulnerabilities in Leading VPNs
Analyzes shuttling Through Secret Pipes: Unveiling Vulnerabilities in Leading VPNs and evaluates key implications for security practitioners.
Summary
Named Pipes in VPN Software
Team T5 engineer Zzy reviews Windows named pipes (NPFS-managed IPC since NT 3.1) used by VPN products for local privilege escalation and impersonation abuse. Targets include WireGuard (open source), CyberGhost (closed), and OpenVPN, building on prior CVEs and Black Hat VPNx research.
Pipe Impersonation Mechanics
Clients connect via CreateFile; servers use CreateNamedPipe and ReadFile/WriteFile like file I/O. With SECURITY_IMPERSONATION or SECURITY_DELEGATION, servers can act in the client’s security context—including remote SMB scenarios—if they hold SeImpersonatePrivilege (default for administrators, service accounts, etc.).
Research Tooling
Challenges include distinguishing pipe I/O from normal file operations and bypassing GetNamedPipeClientProcessId checks. The speaker’s npipeMaster tool actively connects as client/server, injects DLLs to monitor pipe usage, and uses a minifilter driver for system-wide tracing.
Vendor Outcomes
WireGuard and OpenVPN received CVE assignments after responsible disclosure; CyberGhost marked a related issue duplicate. The talk emphasizes secure impersonation preconditions, least privilege, and careful validation of pipe server trust boundaries.
Related talks
BalCCon - Balkan Computer Congress·33 min
Exploiting Smart Contract Vulnerabilities
Discusses balCCon2k23 - Nikola Todorovic - Exploiting Smart Contract Vulnerabilities and evaluates key implications for security practitioners.
Black Hat·44 min
Presenters detail vulnerability discovery and exploitation in Automated Detection of Vulnerabilities in Black-Box Routers (and Other Network Devices).
Black Hat·57 min
Presenters detail vulnerability discovery and exploitation in Automated Detection of Firefox Extension-Reuse Vulnerabilities.