Wait til they learn you can initiate booting the whole OS through DHCP + tftp.
All of which has been common knowledge for network admins 20 years ago. Where did we go wrong?
Novel attack against virtually all VPN apps neuters their entire purpose
51–60 of 77 posts
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#52Not my area of expertise — can somebody clarify if the DHCP server runs on your router, or your local machine? The article keeps mentioning it needs to be on the “same network” but the graphic seems like it’s all on one device. edit: ahh I’m dumb, it’s the router (correct me if I’m wrong!). So as others have said, you have to already be on a compromised network, yes?
DHCP is bit like hotel front and key slip. When a laptop connects to a Wi-Fi, it broadcasts DHCPDISCOVER message using the Wi-Fi card's MAC address, to which local DHCP server responds with IP address + option strings, such as subnet mask, gateway IP, local timezone(but not time), local X Window Manager address, network FQDN, and so on. Every consumer Wi-Fi router has DHCP server program included and set to auto configure, and that is how it's normally operated, but technically multiple servers can coexist within the same subnet, and the server computer doesn't have to be itself the default gateway.
Among the options strings that DHCP server may provide is DHCP option 121 Classless Static Routes, added in 2002, that can "push" routing information to clients for convenience. Apparently this option 121 can be abused to trick your laptop into set and prioritize `route add [google.com] via [malicious_host] dev wlan0` over `route add [google.com] via [vpn_right] dev vpn0` which routes traffic to [google.com], or 0.0.0.0/0 for that matter, through [malicious_host].
DHCP is more of a convenience feature for private IP address LANs, not strictly necessary for operating IP LAN. I've heard generations prior to ours sometimes leased clothespins labeled with IPs off the wall to guests, along instruction papers. DHCP completely automates that.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#53Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
DHCP servers aren't connected to any IP routing mechanisms, so there can be arbitrary numbers of so long there aren't duplicate assignments(but even that isn't DHCP problem). IIRC the client randomly chooses one if multiple offers were received.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#54Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
It's worse than that - an attacker on the same local network as the target machine can tie up the legitimate DHCP server by reserving all available addresses and then start advertising themselves as an alternate DHCP server (to inject the malicious routing to the target).
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#55Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
It's a common scenario. Bars, coffee shops, trains, universities, etc. all offer free public wifi with DHCP outside your control.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#56Encapsulate and encrypt in the app itself, or in the browser.
App (via the openziti sdk): https://blog.openziti.io/no-listening-ports
Browser (the openziti js sdk loads on the fly): https://blog.openziti.io/introducing-openziti-browzer
Disclosure: openziti (apache v2) maintainer
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#57"there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android" I guess it really is the year of the Linux desktop :)
And yet the article goes on to say that Linux doesn't fully mitigate the issue. Confusing.
Linux doesn’t mitigate it out of the box, but you can do this: https://www.wireguard.com/netns/#the-new-namespace-solution
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#58Encapsulate and encrypt in the app itself, or in the browser. App (via the openziti sdk): https://blog.openziti.io/no-listening-ports Browser (the openziti js sdk loads on the fly): https://blog.openziti.io/introducing-openziti-browzer Disclosure: openziti (apache v2) maintainer
Agree. The stated attack is not against an end to end solution.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#59Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
If you dont run your network, you should assume there is a bad actor. Many wifi/router combos have a password of 'admin' or just as easy. Even if the coffee shop giving you wifi is innocent, the person that reconfigured their network in 10 seconds might not be.
But the coffee shop is not offering VPN services, at least none that I would accept.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#60I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blog/post/hardening_openvpn_for_def_co... (under "Attacks on redirect-gateway") It's really hard to make a robust VPN.
Your writeup is IMO much better than the way this is being reported.
FWIW, I remember reading something similar years ago (I'm not certain it was your specific post, but it might have been). It's strange to see this being described as "novel" now, unless there's something new to it that I am missing.