Microsoft’s Vladimir Tokarev on Discovering Critical OpenVPN Vulnerabilities

From a friendly gaming challenge to uncovering critical vulnerabilities, Vladimir Tokarev's journey showcases the power of curiosity in cybersecurity. As a Senior Security Researcher at Microsoft, Tokarev recently unveiled four significant vulnerabilities in OpenVPN's Windows implementation at Black Hat 2024, which he tells Casey all about in this episode of Ahead of the Breach. 

Vladimir’s discovery process, beginning with ExpressVPN and leading to wider implications across multiple VPN providers, demonstrates how deep technical expertise combined with creative thinking can uncover security flaws in even the most widely reviewed open source projects.

Topics discussed:

• How a friendly gaming challenge to find ExpressVPN vulnerabilities led to discovering critical flaws in OpenVPN's core implementation
• The technical details of four chained vulnerabilities, including integer overflow issues and privilege escalation in OpenVPN's Windows service
• Exploring how vulnerable code propagated across VPN providers through shared components, affecting ExpressVPN, Proton VPN, and multiple other services
• Walking through the vulnerability research process using IDA Pro for reverse engineering and WinDbg for kernel debugging in Windows environments
• Understanding how natural curiosity and creative thinking drive successful vulnerability research, from initial discovery through full exploitation
• Strategies for maintaining research momentum during long periods without findings, including the importance of switching tasks and maintaining work-life balance
• Essential advice for newcomers to vulnerability research, focusing on building strong technical foundations and developing systematic approaches to discovery
• How studying newly released CVEs without proof-of-concepts helps develop intuition and provides immediate feedback for improving research skills
• Insights into balancing security research across different domains, from Microsoft's internal products to IoT devices and popular open source projects