EarthVPN certificate configuration vulnerabilities

[y6whynrzab@xxxxxxxxxxx]

EarthVPN (www.earthvpn.com) is a VPN service provider which claims "When 
connected, your data will be secured and encrypted, keeping all your personal 
details private. EarthVPN will make sure that your online presence cannot be 
intercepted, monitored and recorded by your internet service provider, company, 
school or government."

Their server configuration and suggested openvpn setup guide contains a number 
of vulnerabilities.

- The provided CA certificate earthvpn.crt is actually a public certificate 
authority ("GlobalSign Root CA"). This means that anybody can register for a 
valid SSL certificate from GlobalSign.

- the setup guide did not advise to enable the "certificate hostname check" 
(under "authentication/encryption"). This means that a certificate issued by 
GlobalSign to, say, fbi.gov will pass certificate validation, and can result in 
an active man-in-the-middle attack that could eavesdrop on all traffic.

- They appear to be using the same certificate ("*.earthvpn.com") and keys on 
all servers that I've tried to connect to. This means that compromise of any 
one of these servers would allow the theft of private keys that can be used to 
m-i-t-m any other server. Put another way, a Russian dissident might want to 
connect to their  UK servers to avoid interception of his traffic. But the 
Russian government could compel the datacentre in Russia hosting their server 
to reveal its keys. And it can use these keys to intercept and monitor the 
traffic to the UK server (or other servers).

EarthVPN has been contacted about these concerns, and insists that "it is not 
possible to do mitm attack without knowing username and password of the clients 
as authentication will not be succeeded."