TunnelVision attack against VPNs breaks anonymity and bypasses encryption

[harlan4096]

Researchers from Leviathan Security have discovered a new vulnerability that affects virtual private networks (VPNs) on most platforms.

VPNs serve multiple purposes. They encrypt all traffic when connected to a VPN server to prevent eavesdropping and tampering. VPNs furthermore help users stay anonymous, as the VPNs IP address is revealed to websites and services.

TunnelVision is a new attack that manipulates traffic using rogue DHCP servers. All of this happens without dropping of the VPN connection or kill-switch functionality taking note and blocking all Internet connectivity. For the user, the VPN connection appears to work without issues.

TunnelVision Fact Sheet

• Works on all major platforms except for Android.
  
• A potential fix could be developed for Linux.
  
• Requires a rogue DHCP server.
  
• Vulnerability could date back to 2002.
  

TunnelVision in actionThe attack requires access to a DHCP server that the target's device communicates with. The core purpose of DHCP servers is to provide and assign IP addresses to client devices.

DHCP servers support a preference called option code 121, which the attack uses to route the traffic of the target's device through the DHCP server.

The researches explain: "Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway. When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it."

For the attack to work, it is necessary that the target accepts "a DHCP lease" from the rogue DHCP server and that option 121 is implemented. The researches note that attackers who are on the same network as the target may "become their DHCP server" using a number of attack techniques.

Having administrative control over the network is another possibility to attack users who use VPNs to protect their data.

Some or all of a target's traffic may be routed through the unencrypted channel. The VPN program or app continues to report that all data is protected, even while that is not the case.
...

Continue Reading