TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak (CVE-2024-3661) - eviltoast
CVE-2024-3661: TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak — Leviathan Security Group - Penetration Testing, Security Assessment, Risk Advisory
www.leviathansecurity.com
We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
  • Emotet@slrpnk.net
    22·
    6 months ago

    Interesting read.

    So, in short:

    • The attacker needs to have access to your LAN and become the DHCP server, e.g. by a starvation attack or timing attacks
    • The attacked host system needs to support DHCP option 121 (atm basically every OS except Android)
    • by abusing DHCP option 121, the attacker can push routes to the attacked host system that supersede other rules in most network stacks by having a more specific prefix, e.g. a 192.168.1.1/32 will supersede 0.0.0.0/0
    • The attacker can now force the attacked host system to route the traffic intended for a VPN virtual network interface (to be encrypted and forwarded to the VPN server) to the (physical) interface used for DHCP
    • This leads to traffic intended to be sent over the VPN to not get encrypted and being sent outside the tunnel.
    • This attack can be used before or after a VPN connection is established
    • Since the VPN tunnel is still established, any implemented kill switch doesn’t get triggered

    DHCP option 121 is still used for a reason, especially in business networks. At least on Linux, using network namespaces will fix this. Firewall mitigations can also work, but create other (very theoretical) attack surfaces.

    • TheKMAP@lemmynsfw.comEnglish
      2·
      6 months ago

      The problem isn’t necessarily “stuff not sent over vpn isn’t encrypted”. Everyone uses TLS. It’s more that you are no longer NATed behind the VPN egress IP. When governments want to assassinate anyone who touches a destination IP, having the true source IP instead of a VPN source IP is pretty helpful. For this to be practical you first need a botnet of compromised home routers… which they already have.

      In a corporate environment, traffic that is VPN’d typically also undergoes better logging and deep packet inspection.

      • Emotet@slrpnk.net
        2·
        6 months ago

        The problem isn’t necessarily “stuff not sent over vpn isn’t encrypted”. Everyone uses TLS.

        Never said it was. It’s a noteworthy detail, since some (rare) HTTP unencrypted traffic as well as LAN traffic in general is a bit more concerning than your standard SSL traffic contentwise, apart from the IP.

        For this to be practical you first need a botnet of compromised home routers

        This is more of a Café/Hotel Wi-Fi thing IMO. While it may take some kind of effort to get control over some shitty IoT device in your typical home environment, pretty much every script kiddie can at least force spoof the DHCP server in an open network.