sha512 checksums for openvpn files

d4rkcatd4rkcat
edited December 2017 in Feedback
@sn0wmonster
@PIAColleen
@Max-P

Is it possible to get sha512 checksums for the following files hosted on the website?:

https://www.privateinternetaccess.com/openvpn/openvpn-strong-tcp.zip

I can get the checksums myself but it would be nice to post them on the website so we can verify the downloads.
I understand the logic that the files are available over HTTPS and therefore shouldn't be tampered on the way, but they are also available over HTTP (very bad).
If you posted the sha512 checksums on the site somewhere then people could verify if their zips have been tampered before using.
Cheers

Comments

  • Max-PMax-P
    As of now, these are the checksums:

    https://www.privateinternetaccess.com/openvpn/openvpn.zip            - 013154205967e553c2703fe608f6b3d18baead2aefef0e6480534858c3197290953f2cc07231cc45c3f1c22dbae06b60e2620396bc91d0596ea7a4bb34ec580
    https://www.privateinternetaccess.com/openvpn/openvpn-strong.zip     - 86b45f6ee118f410e3a0f82c4172aa3b538736a076ccad0a563dad25aa0147c05e81b95f3f46edd1f3761413110c156014e8ba83b98b5ce721411d813a98615d
    https://www.privateinternetaccess.com/openvpn/openvpn-ip.zip         - 390e2f6ffd69fcc4e66071c097d6332abe2dcee1bbdb9b9a1c4ba15e40914781a4af0b2795dbd36268282b90fc05fc041040f2ab7d5c22b99905803749e02257
    https://www.privateinternetaccess.com/openvpn/openvpn-tcp.zip        - aa88ed700bb5158e74435b92b729dd62bc6c3e36fba2184760cf48fe710a69ad4ead4d4c357925199bffc008ec82944f5245dec671f83b55c4736e4082b43436
    https://www.privateinternetaccess.com/openvpn/openvpn-strong-tcp.zip - 8eabc792edd2926bd43af64245978f13ed4569ee8f7a5be3f04d65b941a20dbc1128ea440b57a2b01cb5ff19bcb5849022e4a90a87136c26d1f46c0b47129638


    Please note however that these are not stable. These files are regularly regenerated when servers are added or removed, or for the -ip variant when the IPs of those regions change, and as such their checksum is going to change.

    Also please note that given that both the checksums and the zip files are provided on the same website, if someone is able to compromise the zip files they also would be able to edit the checksum to match. Just make sure to download them over HTTPS and you should be fine. VPN profiles are just text files, so you can also open them in a text editor to verify that the config makes sense for your needs.
  • d4rkcatd4rkcat
    Max-P said:
    As of now, these are the checksums:

    https://www.privateinternetaccess.com/openvpn/openvpn.zip            - 013154205967e553c2703fe608f6b3d18baead2aefef0e6480534858c3197290953f2cc07231cc45c3f1c22dbae06b60e2620396bc91d0596ea7a4bb34ec580
    https://www.privateinternetaccess.com/openvpn/openvpn-strong.zip     - 86b45f6ee118f410e3a0f82c4172aa3b538736a076ccad0a563dad25aa0147c05e81b95f3f46edd1f3761413110c156014e8ba83b98b5ce721411d813a98615d
    https://www.privateinternetaccess.com/openvpn/openvpn-ip.zip         - 390e2f6ffd69fcc4e66071c097d6332abe2dcee1bbdb9b9a1c4ba15e40914781a4af0b2795dbd36268282b90fc05fc041040f2ab7d5c22b99905803749e02257
    https://www.privateinternetaccess.com/openvpn/openvpn-tcp.zip        - aa88ed700bb5158e74435b92b729dd62bc6c3e36fba2184760cf48fe710a69ad4ead4d4c357925199bffc008ec82944f5245dec671f83b55c4736e4082b43436
    https://www.privateinternetaccess.com/openvpn/openvpn-strong-tcp.zip - 8eabc792edd2926bd43af64245978f13ed4569ee8f7a5be3f04d65b941a20dbc1128ea440b57a2b01cb5ff19bcb5849022e4a90a87136c26d1f46c0b47129638
    Sorry @Max-P , that is completely useless to me as I can already make sha512 sums locally and it doesn't address the security problem I outlined in my OP.

    Max-P said:
    Please note however that these are not stable. These files are regularly regenerated when servers are added or removed, or for the -ip variant when the IPs of those regions change, and as such their checksum is going to change.
    I am aware of that, how hard is it to just post the updated checksums whenever you upload new zips?
    I can make a 2 minute script to help you if you like.

    Max-P said:
    Also please note that given that both the checksums and the zip files are provided on the same website, if someone is able to compromise the zip files they also would be able to edit the checksum to match. Just make sure to download them over HTTPS and you should be fine. VPN profiles are just text files, so you can also open them in a text editor to verify that the config makes sense for your needs.

    FYI i am the author of https://github.com/d4rkcat/pia and so am very aware of how ovpn files work, it's not for me as I would never download these files over HTTP, but more for new users who are not security aware.
    You are also not considering that over HTTP, an attacker on a local network or even a state actor could easily replace the zips on their way from your server to the end user with a malicious zip that would make the end user think they are connecting securely to PIA, when if fact they could connect to anywhere. This could also lead to theft of credentials.
    There are two possible solutions to this security hole:
    1. Stop serving config files over HTTP.
    2. Post the checksums and tell the end users they must check them before use. 
    I recommend doing both. It's an easy fix and requires little effort, but will substantially improve the security of your service.
    Cheers.
  • [Deleted User][Deleted User]
    @d4rkcat Apologies for not seeing this thread sooner. I totally agree with you. The PIA app itself verifies such things so there's no logical excuse not to recommend it for OpenVPN users too. How we go about it is something I'll investigate. Stay tuned!
  • d4rkcatd4rkcat
    @sn0wmonster
    Cheers bud, I don't think its acceptable to wait for PIA to realise the significance of this so I hacked together a solution for my linux client.

    It checks the Last-Modified field of the headers for the file using curl eg:
    curl -sI https://www.privateinternetaccess.com/openvpn/openvpn.zip

    And compares it to previous updates time stamps.
    This doesn't help people who use raw openvpn but at least users of my script will be safe and up to date :)
  • Max-PMax-P
    @d4rkcat You don't really need to update that file. I'm not sure how you would validate the checksums in an automated manner anyway? Checksums checks for file integrity, they wouldn't help

    I think for what you're trying to achieve, using the vpninfo (undocumented) API is probably a better idea. That way you can update the server list itself rather than redownloading the profiles. You only need one template profile and fill the info in. This API is also signed, although I don't have the public key on hand to validate that signature. If you load it over HTTPS it won't matter much.
  • d4rkcatd4rkcat
    Max-P said:
    @d4rkcat You don't really need to update that file.
    Hi @Max-P , I find it is the easiest way and in programming, the simplest solution is always the best, most elegant and most easy to understand. I want people to read my code and understand it easily. More complex code is always more error prone. KISS
    Max-P said:
    I'm not sure how you would validate the checksums in an automated manner anyway? Checksums checks for file integrity, they wouldn't help
    I planned to retrieve the checksums from the website by curling the webpage source where they were hosted, and then compare them to the checksums of the config zip that was already on the system. If there were any changes at all, You could be sure that an update had occurred, at which point I could inform the user and download the new config files.
    Checksums are also useful for the first time a user downloads the zips. They could be checked to make sure they are what PIA intends them to be, it is a very common practice with software written by security minded developers. 
    See https://www.kali.org/downloads/ and note the checksums prominently displayed next to the download links.

    Max-P said:
    I think for what you're trying to achieve, using the vpninfo (undocumented) API is probably a better idea. That way you can update the server list itself rather than redownloading the profiles. You only need one template profile and fill the info in. This API is also signed, although I don't have the public key on hand to validate that signature. If you load it over HTTPS it won't matter much.
    That is pretty cool, thanks very much. I don't have a use for it right now but it is interesting to see. Any further information you could provide on how to make my client better/safer for users would be much appreciated. I think my client is at least as secure as the official one at this point, with the added advantage of using whatever version of OpenVPN the user has on their system, which on Arch, is the bleeding edge newest one (2.4.4).

    Cheers
Sign In or Register to comment.