What is the VORACLE attack, and why Proton VPN is not vulnerable

A new security vulnerability in the OpenVPN protocol was recently revealed that would allow for sophisticated attacker to access a VPN user’s online activity.

At the most recent Black Hat and DEF CON(new window) security conferences, tech security researcher Ahamed Nafeez presented VORACLE, an attack that can eventually allow the attacker to decrypt data protected by the VPN. Shortly after the presentation, the Proton VPN team immediately began investigating our infrastructure for this vulnerability. Less than a day after Nafeez’s presentation, all Proton VPN servers which were susceptible to VORACLE have been updated and secured. More details about the attack and how we mitigated it can be found below.

A VORACLE attack

VORACLE is a remix of the older BREACH and CRIME cryptographic attacks. It decrypts HTTP traffic sent through VPNs built on OpenVPN protocols. It takes advantage of the fact that OpenVPN’s default setting is to compress all data before encrypting it with TLS. If an attacker repeatedly adds plain text information into the data prior to compression and then recovers the passing traffic, they can measure the packet length and then compare it to brute-forced potential value. This could eventually allow them to obtain the session cookie or session data.

a voracle attack eplained

Since the VORACLE attack requires that the attacker be able to insert plain text information into the data before encryption and see the data after it has been encrypted, it often requires the attacker lure you to an HTTP site – either one under the attacker’s control or one where they can execute malicious code. Even then, using a Chromium-based browser (Chrome) can foil the attack since they split HTTP requests into multiple parts. Effectively, this makes the VORACLE attack hard to carry out in practice, although not impossible.

Proton VPN’s solution

As ingenious as the VORACLE attack is, it relies on OpenVPN’s default setting of compressing data before encryption. To protect against VORACLE, we have disabled compression on our OpenVPN servers. This eliminates the possibility of such an attack being used against Proton VPN users. Our initial assessment shows that disabling compression also does not lead to a noticeable performance degradation. For most users, the impact is less than one percent. In some cases, you may even experience faster performance due to decreased latency.

Best Regards,
The Proton VPN Team

You can follow us on social media to stay up to date on the latest Proton VPN releases:

Twitter (new window)| Facebook(new window) | Reddit(new window)

To get a free Proton Mail encrypted email account, visit: proton.me/mail(new window)

Protect your privacy and security online
Get Proton VPN free

Related articles

Update July 18, 2024: This article has been updated to feature the latest audit of our no-logs policy by Securitum, which was concluded on July 12, 2024. Links to all our no-logs policy audits are included. We’re pleased to announce that Proton VPN
VPN on mobile device
Growing public awareness about the threat posed to our fundamental right to privacy by online trackers has fueled a surge in VPN adoption, a trend that has been boosted thanks to people spending more time online due to the Covid-19 pandemic. Althoug
Tor over VPN
  • Privacy deep dives
Tor is a powerful privacy tool, but you may not want to use Tor all by itself. Learn why you may want to connect to Tor over a VPN. When you connect to the Internet, especially if you’re using public WiFi, there’s a good chance people are watching y
Smart TV privacy
Smart TVs are essentially televisions that can watch you. Their surge in popularity, along with smart speakers, means corporations (and anyone that can hack these devices) have another window through which they can view your private activity. The dat
Expats should use a VPN
Living abroad can be an adventure, but it also presents unique online privacy obstacles. A VPN can help expats stay in touch with their family and avoid Internet censorship. In the age of the “digital nomad” more and more people are moving abroad. L
The internet is full of information, but some of it is inappropriate, especially for kids and sensitive adults. SafeSearch can help filter out this content to make browsing safer and improve your children’s privacy online. This article explains how