Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attackers can decloak routing-based VPNs

leviathansecurity.com

Post reply on HN
Print view View original

31–40 of 238 posts

Re: Attackers can decloak routing-based VPNs

#31

Post by morattisec »

acer4666 wrote: post #3

Is there a tl;dr so we don't have to wade through swathes of AI generated text explaining what a network is?

You probably followed the advice to read from the 121 section already but if you’re sharing this others it might be helpful to link our website that serves as a TLDR + FAQ. https://tunnelvisionbug.com/

There’s also a general public advisory there that’s supposed to be for anyone non-technical but who wants to understand the issue. All this content was also written by hand over 8ish months too, no AI was used

Re: Attackers can decloak routing-based VPNs

#32

Post by bimguy »

morattisec wrote: post #20
Aloisius wrote: post #6

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher priority than the default 0.0.0.0/0 rule due to higher specificity (longer prefix).

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you sho…

Great write up by the way. Even some technical people might not know about this, not all technical people are network experts after all.

Re: Attackers can decloak routing-based VPNs

#33

Post by Aurornis »

pushedx wrote: post #10

The threat model is that an arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible. On the other hand, if you are using an ISP provided gateway device..

The risk is outside the home: Using a VPN at the coffee shop, hotel, office, etc.

Re: Attackers can decloak routing-based VPNs

#34

Post by tgsovlerkhgsel »

pushedx wrote: post #10

The threat model is that an arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible. On the other hand, if you are using an ISP provided gateway device..

That's one of the commonly advertised reasons to use VPNs: protection in untrusted WiFi networks.

Re: Attackers can decloak routing-based VPNs

#35

Post by k0ss_net »

I swore I had already read about this attack from some other author, so I went searching and after sifting through tons of VPN provider spam in search results I found the prior work [1].

This new article goes into some more depth on how to exploit the flaw and has some code to help PoC it though.

1: https://www.usenix.org/conference/usenixsecurity23/presentat...

Re: Attackers can decloak routing-based VPNs

#36

Post by flir »

pushedx wrote: post #10

The threat model is that an arbitrary attacker can somehow become the DHCP server on your LAN, which is unlikely but not impossible. On the other hand, if you are using an ISP provided gateway device..

Surely one of the big use-cases for a VPN is that the network you're connected to is untrusted?

Re: Attackers can decloak routing-based VPNs

#37

Post by wrs »

morattisec wrote: post #31
acer4666 wrote: post #3

Is there a tl;dr so we don't have to wade through swathes of AI generated text explaining what a network is?

You probably followed the advice to read from the 121 section already but if you’re sharing this others it might be helpful to link our website that serves as a TLDR + FAQ. https://tunnelvisionbug.com/ There’s also a general public advisory there that’s supposed to be for anyone non-technical but who wants to understand the issue. All this content was also written by hand over 8ish months too, no AI was used

This is a great explanation of basic networking mechanisms that most people know almost nothing about. Don’t listen to the haters.

I feel that I’m in a high percentile for networking knowledge, but I didn’t know about option 121!

Re: Attackers can decloak routing-based VPNs

#38

Post by m463 »

bedobi wrote: post #9

VPN can be trivially defeated any number of ways. I was shocked when I first learned this ten fifteen years ago through a site that showed my internet provider and location despite being on a VPN. I forgot the name of the site. A huge problem that doesn't even require defeating is, most OSs and VPN clients, if the connection is shaky, just reverts to the default connection. Even a single packet is enough for your VPN…

Can just be location services - it uses known bluetooth devices and known wifi networks to deduce your location

Re: Attackers can decloak routing-based VPNs

#39

Post by tinco »

yjftsjthsd-h wrote: post #27
ls612 wrote: post #15

So for this attack does the attacker need to control your internet router? Or does it only need to control ISP infrastructure?

Pretty sure the attacker has to control your DHCP server, which in ex. a home environment is usually the router.

No, the attacker just has to be on the network. When on the network the attacker can deploy various techniques to become the DHCP server. Since it's (relatively) easy to become a DHCP server on a network, it's considered a big deal when the DHCP server can trick you into doing something like in this case decloaking your VPN traffic.

Re: Attackers can decloak routing-based VPNs

#40

Post by tgsovlerkhgsel »

morattisec wrote: post #20
Aloisius wrote: post #6

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher priority than the default 0.0.0.0/0 rule due to higher specificity (longer prefix).

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you sho…

The PoC section doesn't explain the issue. I think a one-line TL;DR similar to the summary above would be best, e.g. "A malicious DHCP server can use DHCP Option 121 to set routing rules, which can override the routing rule used by VPNs and cause traffic to be routed outside the VPN"

(I like it that you provide the background for people who need it, but also found the actually relevant information extremely annoying to find.)

Post reply on HN