Interestingly, Android is the only operating system that fully immunizes VPN apps from the attack because it doesn’t implement option 121. For all other OSes, there are no complete fixes. When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks.
I did not look into that setting that minimises the effect but from the way it’s written it sounds like this isn’t used by default, so by default you’re still vulnerable. Add even if it’s on, there’s still a side vulnerability.
well, im not as im not using interfaces that are affected by the vulnerability (im using named, containerized network interfaces), but i appreciate the info!
it was initially reported as ‘linux & android’ were not affected.
i stand by my statement that this isnt about the VPN provider, its a client problem. so the question about Proton is moot.
I think by client you mean the device and operating system, which is correct to my understanding, but it’s confusing because ‘client’ can also mean the VPN client software which is often supplied by the VPN provider, and that’s what I first think when you say client. So with that in mind it sounds like you’re saying “it’s not about the VPN but the VPN software” which obviously comes from the same provider.
I have not looked into it so you probably understand this more than I, but from the sound of it the VPN software can be built to detect, prevent or counteract the exploit even on affected systems? In which case, even though it’s an environment issue it can still be resolved by the VPN provider.
That we haven’t heard anything from proton regarding this vulnerability is not a good sign. Article came out on May 6th and proton has only published basic privacy guides.
its about the client.
im using linux so im not affected using proton.
Linux is affected.
source?
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
I did not look into that setting that minimises the effect but from the way it’s written it sounds like this isn’t used by default, so by default you’re still vulnerable. Add even if it’s on, there’s still a side vulnerability.
well, im not as im not using interfaces that are affected by the vulnerability (im using named, containerized network interfaces), but i appreciate the info!
it was initially reported as ‘linux & android’ were not affected.
i stand by my statement that this isnt about the VPN provider, its a client problem. so the question about Proton is moot.
I think by client you mean the device and operating system, which is correct to my understanding, but it’s confusing because ‘client’ can also mean the VPN client software which is often supplied by the VPN provider, and that’s what I first think when you say client. So with that in mind it sounds like you’re saying “it’s not about the VPN but the VPN software” which obviously comes from the same provider.
I have not looked into it so you probably understand this more than I, but from the sound of it the VPN software can be built to detect, prevent or counteract the exploit even on affected systems? In which case, even though it’s an environment issue it can still be resolved by the VPN provider.
youre correct. its the local routing table that is vulnerable, which is usually handled by the OS.
I had not yet heard of any mitigation techniques from the vpn provider side. glad to know they are assisting with this OS/client failure.
I have no idea if they are assisting, it’s all baseless conjecture on my part! Sorry if that wasn’t clear, I thought it was
Mullvad already published a blog post a day after stating they reviewed the vulnerability, and it was closed up during their process of fixing a different vulnerability. https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
That we haven’t heard anything from proton regarding this vulnerability is not a good sign. Article came out on May 6th and proton has only published basic privacy guides.