SoftEther VPN 4.38 Build 9760 RTM

SoftEther VPN 4.38 Build 9760 RTM (August 17, 2021)
• Improve the stability of IPsec function with reducing consuming CPU time / network bandwidth / memory consumption even if your server receive a large number of IPsec packets from indiscriminate attack attempts (brute force attacks, reflection attacks, etc.) targeting generic IPsec VPN devices, which have been occurring frequently on the Internet recently.
• This RTM build includes all changes from the previously released Beta versions, Build 9754 and Build 9758.
• If you are using the system with L2TP/IPsec, EtherIP/IPsec or L2TPv3/IPsec features enabled, we recommend that you apply the update. In addition, if you have been receiving indiscriminate attack attempt packets targeting IPsec VPN devices, which have been occurring frequently on the Internet since around August 2021, and have been experiencing reduced communication speed or failed VPN connections for legitimate users, we recommend that you apply the update.

SoftEther VPN 4.37 Build 9758 Beta (August 16, 2021)
• The frequency of notification of disconnected tunnel identification numbers via IPsec Informational Exchange packets is now limited, reducing the occurrence of nonsensical packet ping-pong between attackers targeting IPsec VPN devices with a wide range of global IP addresses.
• Recently, we have observed a brute-force cyber attack that originates from several IP addresses of cloud services and indiscriminately attempts to penetrate the network via IPsec VPN against a wide range of global IP addresses of the victim. Based on the behavior of the packets, it is believed that this cyber attack uses a dictionary attack to identify the pre-shared key of the IPsec VPN when a guessable word is used in the pre-shared key, and then establishes an IPsec VPN tunnel to break into various corporate networks. This cyber attack is considered to be an attempt to establish an IPsec VPN tunnel to infiltrate various corporate networks. This cyber attack does not target SoftEther VPN, and there is no possibility that SoftEther VPN will be affected directly at present.
• However, if you have enabled the L2TP/IPsec, EtherIP/IPsec, or L2TPv3/IPsec features of SoftEther VPN and have not changed the recommended pre-shared key to "vpn" (the default value of three characters), such an attack will establish an IPsec layer tunnel with the attacker's host. In an environment where the pre-shared key has not been changed (strongly not recommended dangerous usage), such an attack will establish an IPsec layer tunnel with the attacker's host. Since L2TP authentication, etc. is not actually established afterwards, even if the attacker does not break into the network, resources such as CPU, memory, and network bandwidth of the host used as the VPN server may be wasted as a result. Especially, SoftEther VPN disconnects the IPsec tunnel established with the attacker when there is no communication for a certain period of time. When SoftEther VPN receives a packet addressed to the identification number of the tunnel that has already been disconnected, it sends a notification to the source IPsec client that the tunnel has been disconnected. This is called an IPsec Informational Exchange packet. The implementation behavior of a bad source IPsec client (the program written by the attacker) is that when the IPsec Informational Exchange packet arrives, the attack host resends another ESP frame to the VPN server. This results in ping-pong between the attacker's program and the IPsec module of the VPN server of SoftEther VPN, which is completely unintended by the attacker, resulting in completely useless consumption of each other's CPU, memory, and network bandwidth. From the point of view of the VPN server administrator, while the attacker is sending IPsec packets in rapid succession, VPN communication by legitimate L2TP/IPsec users will be slowed down or fail to establish VPN communication. The attacker is at a disadvantage.
• The above notification mechanism of the disconnected tunnel identification number by IPsec Informational Exchange packets is not a bug of SoftEther VPN, but the original intended behavior. However, if the above ping-pong phenomenon occurs and consumes CPU, memory and network bandwidth, it will affect legitimate users. Therefore, in the new build Ver 4.37 Build 9758 released on 08/15/2021, we have implemented a rate limit on the process of sending back IPsec Informational Exchange packets. Specifically, for communications from a particular IPsec client host, we have limited the number of IPsec Informational Exchange packets that can be sent back to the client host to a maximum of 20 per second, after which no further responses will be made.
• With this new build, even if an attacker establishes an aggressive IPsec VPN session in an environment where the recommended pre-shared key has not been changed to "vpn" (the default value of three characters, dangerous and not recommended), the consumption of CPU, memory and network bandwidth will be reduced.
• Regardless of the above measures, if you have not changed the recommended pre-shared key to "vpn" (the default value of 3 characters), it is not recommended to use the pre-shared key with the default value of "vpn", so it is recommended to change it to a more complex string of 8 characters or more, as per the guidance message in the VPN server configuration tool, regardless of the presence of this phenomenon.

SoftEther VPN 4.36 Build 9754 Beta (June 07, 2021)
• Add Linux ARM 64bit CPU support. (now works on ARM 64bit CPUs such as Raspberry Pi 4.)
• Updated OpenSSL version to 1.1.1k.
• Fixed the same directory DLL loading problem in the installer (vpnsetup).
• Japanese government's public personal authentication JPKI 64bit support
• Support for older SH4 CPUs has been removed.
• Fixed an issue that caused malformed packets to be generated when the DHCP option exceeded 255 bytes, such as when the static route push feature of the Virtual DHCP Server feature configured more than 28 routes.