Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attackers can decloak routing-based VPNs

leviathansecurity.com

Post reply on HN
Print view View original

41–50 of 238 posts

Re: Attackers can decloak routing-based VPNs

#41

Post by wolverine876 »

morattisec wrote: post #20
Aloisius wrote: post #6

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher priority than the default 0.0.0.0/0 rule due to higher specificity (longer prefix).

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you sho…

What I read does a great job of explaining the technology; I know it pretty well but it's great to have an updated, clear, concise, well-organized, integrated explanation all in one place. I can't imagine how long that took to make it that clear!

(Everything posted here gets similar complaints about the writing, headline, too short, too long, too hot, too cold, etc. Goldilocks is never pleased here. Welcome to HN! :)

Re: Attackers can decloak routing-based VPNs

#42

Post by nonrandomstring »

morattisec wrote: post #20
Aloisius wrote: post #6

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher priority than the default 0.0.0.0/0 rule due to higher specificity (longer prefix).

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you sho…

Good call. For a general IT audience you are speaking to, context building really helps refresh the scene before dropping the exploit. Well communicated.

Re: Attackers can decloak routing-based VPNs

#43

Post by wolverine876 »

tgsovlerkhgsel wrote: post #40
morattisec wrote: post #20

Earlier quoted context omitted.

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you sho…

The PoC section doesn't explain the issue. I think a one-line TL;DR similar to the summary above would be best, e.g. "A malicious DHCP server can use DHCP Option 121 to set routing rules, which can override the routing rule used by VPNs and cause traffic to be routed outside the VPN" (I like it that you provide the background for people who need it, but also found the actually relevant information extremely annoying…

> found the actually relevant information extremely annoying to find

Skip down to the DHCP section?

Re: Attackers can decloak routing-based VPNs

#44

Post by idkdotcom »

morattisec wrote: post #20
Aloisius wrote: post #6

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher priority than the default 0.0.0.0/0 rule due to higher specificity (longer prefix).

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you sho…

Have you identified actual VPN vendors that are affected by this? I won't disclose which ones I use, but I would love to know if they have been affected.

Re: Attackers can decloak routing-based VPNs

#45

Post by JackSlateur »

Aloisius wrote: post #24
fargle wrote: post #14

always the breathless sensationalized vulnerability headlines... it's interesting, but of limited usefulness - the device has to accept responses from a dhcp server. if an attacker controls a dhcp server, he's either on the network already or has already had to do a lot worse than installing a couple static routes to get there. it's not nothing - a compromised home gateway could use this technique to sneak into a cor…

I think a public wifi network effectively being able to disable someone's VPN is pretty bad.

There are lots of ways to disable vpn : basic firewall on the router, if you have access ARP poisoning if you do not.

Re: Attackers can decloak routing-based VPNs

#46

Post by morattisec »

yjftsjthsd-h wrote: post #27
ls612 wrote: post #15

So for this attack does the attacker need to control your internet router? Or does it only need to control ISP infrastructure?

Pretty sure the attacker has to control your DHCP server, which in ex. a home environment is usually the router.

This is mostly correct, in our POC video we showcase a lab where we go from being an adjacent host on the network to being the DHCP server.

We did this by DHCP starving the true DHCP server and hoarding all the leases. Then we serve our own and do not have to compete with the true DHCP.

There’s network protections against this such as guest network isolation or switches with DHCP snooping protections. However, those are usually on enterprises and relying on those being in place kind of removes the point of “securing an untrusted network” like many VPN providers claim.

Re: Attackers can decloak routing-based VPNs

#47

Post by ls612 »

tinco wrote: post #39
yjftsjthsd-h wrote: post #27

Earlier quoted context omitted.

Pretty sure the attacker has to control your DHCP server, which in ex. a home environment is usually the router.

No, the attacker just has to be on the network. When on the network the attacker can deploy various techniques to become the DHCP server. Since it's (relatively) easy to become a DHCP server on a network, it's considered a big deal when the DHCP server can trick you into doing something like in this case decloaking your VPN traffic.

What is the fix for this vulnerability? Is it the router that needs to get a software update, the VPN client, the OS, or some/all of the above?

Re: Attackers can decloak routing-based VPNs

#48

Post by bedobi »

m463 wrote: post #38
bedobi wrote: post #9

VPN can be trivially defeated any number of ways. I was shocked when I first learned this ten fifteen years ago through a site that showed my internet provider and location despite being on a VPN. I forgot the name of the site. A huge problem that doesn't even require defeating is, most OSs and VPN clients, if the connection is shaky, just reverts to the default connection. Even a single packet is enough for your VPN…

Can just be location services - it uses known bluetooth devices and known wifi networks to deduce your location

can be but that wasn't what i was experiencing

Re: Attackers can decloak routing-based VPNs

#49

Post by gnabgib »

k0ss_net wrote: post #35

I swore I had already read about this attack from some other author, so I went searching and after sifting through tons of VPN provider spam in search results I found the prior work [1]. This new article goes into some more depth on how to exploit the flaw and has some code to help PoC it though. 1: https://www.usenix.org/conference/usenixsecurity23/presentat...

That article is referenced in the Appendix:

  However, neither technique described in the August 2023 paper leveraged DHCP option 121 to push routes. Pushing routes through DHCP has a significantly higher impact from the same attacker vantage point (the ability to hand out IP leases for a non-RFC1918 range or spoofing DNS replies).

Re: Attackers can decloak routing-based VPNs

#50

Post by AnotherGoodName »

tristor wrote: post #25

There are numerous ways to defeat a VPN on a client device, this is why I prefer to put a router that terminates VPN tunnels with no other available routes between my clients and the Internet when I feel the need for a VPN. You can trivially set up one of these "travel routers" and carry it with you everywhere, which is exactly what I do.

I highly encourage dedicated VPN routers at home with each router having it's own wifi network as a way to connect to VPNs. It's easier to connect and more reliable than locally running VPN software on each device imho.

Eg. I have a router sharing wifi for 'work' with a permanently maintained vpn connection to the workplace intranet. Another sharing wifi as 'Australia' that I connect to whenever I want to watch TV from Australia with a VPN to an Australian server and lastly the standard home Internet wifi.

It's super easy to do if you have a couple of old wifi routers and even cheap home ones seem to have some VPN support these days. A big advantage, aside from centralizing the VPN setup so you don't screw it up is that it's trivial to connect any device to the VPN. Just join the relevant wifi address! Boom I'm now in a VPN to Australia from any device without messing around setting up that device specifically because I connected to the 'Australia' wifi.

I do this with multiple old routers but I actually think there's probably a market for a single home router that vpns to multiple locations in the world with a different wifi network for each of those just for the sake of easily having your TV/Roku/iPad appearing to be from somewhere else trivially.

Post reply on HN