Is LogMeIn Hamachi safe? LogMeIn Hamachi employs AES 256-bit encryption to protect your data. This encryption standard is used in various security-intensive settings, such as finance or the military. The service provider is the LogMeIn company, created in 2003, which is yet to find itself in any type of scandal. Hamachi by itself puts no extra risk on your machine. You pretty much have to look at it as if hamachi is a very long ethernet cable that you plug into another network. It is the network you are plugging into that is your risk and you use standard stuff like firewalls and such to protect yourself.
Screenshot of the Hamachi Client, showing a joined network and other users who are participating | |
| Original author(s) | Alex Pankratov |
|---|---|
| Developer(s) | LogMeIn Inc. |
| Stable release | |
| Operating system | Microsoft Windows (XP or later), macOS, Linux, Linux on ARM (beta) |
| Type | P2P, VPN |
| License | Proprietary (Free of charge for up to 5 devices) |
| Website | https://www.vpn.net |
LogMeIn Hamachi is a virtual private network (VPN) application written by Alex Pankratov in 2004.[2] It is capable of establishing direct links between computers that are behind network address translation ('NAT') firewalls without requiring reconfiguration (when the user's PC can be accessed directly without relays from the Internet/WAN side); in other words, it establishes a connection over the Internet that emulates the connection that would exist if the computers were connected over a local area network ('LAN').
Hamachi was acquired from Pankratov by LogMeIn in 2009.[3] It is currently available as a production version for Microsoft Windows and macOS, as a beta version for Linux, and as a system-VPN-based client compatible with Android and iOS.
For paid subscribers Hamachi runs in the background on idle computers. The feature was previously available to all users but became restricted to paid subscribers only.
Operational summary[edit]
Hamachi is a proprietary centrally-managed VPN system, consisting of the server cluster managed by the vendor of the system and the client software, which is installed on end-user computers.Client software adds a virtual network interface to a computer, and it is used for intercepting outbound as well as injecting inbound VPN traffic. Outbound traffic sent by the operating system to this interface is delivered to the client software, which encrypts and authenticates it and then sends it to the destination VPN peer over a specially initiated UDP connection. Hamachi currently handles tunneling of IP traffic including broadcasts and multicast. The Windows version also recognizes and tunnels IPX traffic.
Each client establishes and maintains a control connection to the server cluster. When the connection is established, the client goes through a login sequence, followed by the discovery process and state synchronization. The login step authenticates the client to the server and vice versa. The discovery is used to determine the topology of the client's Internet connection, specifically to detect the presence of NAT and firewall devices on its route to the Internet. The synchronization step brings a client's view of its private networks in sync with other members of these networks.
When a member of a network goes online or offline, the server instructs other network peers to either establish or tear down tunnels to the former. When establishing tunnels between the peers, Hamachi uses a server-assisted NAT traversal technique, similar to UDP hole punching. Detailed information on how it works has not been made public. This process does not work on certain combinations of NAT devices, requiring the user to explicitly set up a port forward. Additionally 1.0 series of client software are capable of relaying traffic through vendor-maintained 'relay servers'.
In the event of unexpectedly losing a connection to the server, the client retains all its tunnels and starts actively checking their status. When the server unexpectedly loses client's connection, it informs client's peers about the fact and expects them to also start liveliness checks. This enables Hamachi tunnels to withstand transient network problems on the route between the client and the server as well as short periods of complete server unavailability.Some Hamachi clients also get closed port on other clients, which cannot be repaired by port forwarding.
Hamachi is frequently used for gaming and remote administration. The vendor provides free basic service, and extra features for a fee.
In February 2007, an IP-level block was imposed by Hamachi servers on parts of Vietnamese Internet space due to 'the scale of the system abuse originating from blocked addresses'. The company is working on a less intrusive solution to the problem.[citation needed]
Addressing[edit]
Each Hamachi client is normally assigned an IP address when it logs into the system for the first time. To avoid conflicting with existing private networks on the client side the normal private IP address blocks 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are not used.
Before November 19, 2012 the 5.0.0.0/8 range was used. This range was previously unallocated but was allocated to RIPE NCC in late 2010 and space from this range is now being used by hosting providers on the public internet. Hamachi switched to the 25.0.0.0/8 block.[4]
The 25.0.0.0/8 block is allocated to the British Ministry of Defence. Organisations who need to communicate with the MOD may experience problems when more specific Internet routes attract traffic that was meant for internal hosts, or alternatively find themselves unable to reach the legitimate users of those addresses because those addresses are being used internally,[5]and such 'squatting' is against the established practice of the Internet.
The client now supports IPv6, and if this is selected then the address assigned is picked from a range registered to LogMeIn.[4]
The IP address assigned to the Hamachi client is henceforth associated with the client's public crypto key. As long as the client retains its key, it can log into the system and use this IP address. Hamachi creates a single broadcast domain between all clients. This makes it possible to use LAN protocols that rely on IP broadcasts for discovery and announcement services over Hamachi networks.
Security[edit]
The following considerations apply to Hamachi's use as a VPN application:
- Additional risk of disclosure of sensitive data which is stored or may be logged by the mediation server — minimal where data is not forwarded.
- The security risks due to vulnerable services on remote machines otherwise not accessible behind a firewall, common to all VPNs.
- Hamachi is stated to use strong, industry-standard algorithms to secure and authenticate the data and its security architecture is open. Despite this, security cannot necessarily be guaranteed.[6]
- The existing client-server protocol documentation contains a number of errors,[7][8] some of which have been confirmed by the vendor, pending correction,[9] with others not yet confirmed.
- For the product to work, a 'mediation server', operated by the vendor, is required.
- This server stores the nickname, maintenance password, statically-allocated 25.0.0.0/8 IP address and the associated authentication token of the user. As such, it can potentially log actual IP addresses of the VPN users as well as various details of the session.
Compatibility[edit]
The current builds of Hamachi are available for the following operating systems:[10]
- Microsoft Windows (XP or later)
- macOS (Mac OS X 10.6 or newer; Intel-based Macs only)
- Linux (beta)
- FreeBSD users can install and utilize Linux version, there's a port created in FreeBSD Ports.
- iOS (via iOS system VPN)
- Android (via Android system VPN)
Prior to versions 1.0.2.0 and 1.0.2.1 for the Windows release,[11] many Windows Vista users had experienced compatibility and connection issues while using Hamachi. As of March 30, 2007, the software now includes Vista tweaks, which answer these OS-related problems, among other specific solutions.[12]
See also[edit]
- Network address translation (NAT) Overview, related RFCs: RFC 4008, RFC 3022, RFC 1631 (obsolete)
- Simple Traversal of UDP over NATs (STUN), a NAT traversal protocol defined in RFC 3489 (obsoleted by RFC 5389)
- Session Traversal Utilities for NAT (Updated STUN, as defined in RFC 5389)
- UDP hole punching another NAT traversal technique
References[edit]
- ^'Hamachi Release Notes'
- ^'Hamachi: The virtual private networking system'. Personal website of Alex Pankratov. Retrieved 2019-01-16.
- ^'Hamachi: The virtual private networking system'. Personal website of Alex Pankratov. Retrieved 2019-01-16.
- ^ ab'Changes to Hamachi on November 19th'Archived March 25, 2015, at the Wayback Machine, Official LogMeIn product blog
- ^Vegoda, Leo. 'Used but Unallocated: Potentially Awkward /8 Assignments'. The Internet Protocol Journal — Volume 10, No. 3. Cisco.com. Retrieved 2011-03-25.
- ^'LogMeIn Hamachi2 Security Whitepaper'. Logmeinsupport.com. Retrieved 2011-04-12.[permanent dead link]
- ^Hamachi protocol documentation errors. Hamachi.cc forums.[dead link]
- ^More Hamachi protocol documentation concerns. Hamachi.cc forums.[dead link]
- ^Acknowledgement of documentation errors. Hamachi.cc forums.[dead link]
- ^'FAQ: What are the system requirements for LogMeIn Hamachi?'. LogMeIn, Inc. Retrieved 13 June 2015.
- ^'Hamachi for Windows, change log'. Hamachi.cc. Retrieved 2011-04-12.[failed verification]
- ^'Hamachi Community Forums - 1.0.2.1 is released'. Forums.hamachi.cc. Retrieved 2011-04-12.[failed verification]