[Security Advisory] Lack of Protection Against Replay Attacks in shadowsocks-windows' Implementation

[database64128]

Impact

Medium

Details

Due to the absence of an IV filter in our Shadowsocks client implementation, shadowsocks-windows is subject to replay attacks that could potentially be used to identify the existence of the Shadowsocks client or server.

Lack of replay protection on the client side is not as severe as it is on the server side. But we still consider it a basic requirement for Shadowsocks client implementations.

Related Information

• https://gfw.report/blog/gfw_shadowsocks/
• Shadowsocks AEAD 加密方式设计存在严重漏洞，无法保证通信内容的可靠性 shadowsocks-org#183

Affected Versions

All versions.

Resolution

We advise that users switch to implementations with an IV filter in place, such as shadowsocks-rust, and go-shadowsocks2. V2ray, Xray, and clash are known to not have the necessary protection, and therefore should not be used to interact directly with a Shadowsocks server.

Since we can barely keep up with what we've planned for version 5, we are considering switching to shadowsocks-rust as the default backend in our next major release. Shadowsocks-rust is being actively maintained, and has been used by shadowsocks-android as the backend since last year. I have recently done some benchmarks on several client implementations, and the results show good performance with shadowsocks-rust that we could've never reached on .NET.

[RPRX]

实际上，对于针对客户端的 Replay Attack，即使有 IV 过滤器，还需要做到“单一客户端且不重启”，而客户端经常会重启。
其实对服务端也是同理，需要做到“单一服务端且不重启”，只是服务端重启的次数会少很多。
所以目前针对无论哪一边的 Replay Attack，换实现并不能有效解决问题。

而我在 shadowsocks/shadowsocks-org#183 中提到的 移花接木问题，属于 SS 协议长期的设计缺陷，目前任何实现都无解。

[desitashan]

Nicely posted, im looking forword to seeeing more from you

[8x8-64]

我提过一个建议在生成IV时加入时间戳因子，减少记录表大小。shadowsocks/shadowsocks-org#150
移花接木问题，只要同时记录自己发出包和接收包的iv，就能识别出来