Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Novel attack against virtually all VPN apps neuters their entire purpose

arstechnica.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#31

Post by gruez »

mycall wrote: post #16
agwa wrote: post #2

I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blog/post/hardening_openvpn_for_def_co... (under "Attacks on redirect-gateway") It's really hard to make a robust VPN.

How hard is it for a firewall to block option 121 (and 33)? Cloudflare WARP made a robust VPN but is not cheap.

It's probably more straightforward to have the firewall block all traffic from using the non-VPN interfaces (ie. blacklist approach) instead. In the other thread[1] there was disagreement about whether commercial VPN services actually implement their 'killswitch" in this way. Apparently NordVPN does not (hearsay), but neither side provided a good survey of other providers.

[1] https://news.ycombinator.com/item?id=40279632

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#32

Post by gruez »

bscphil wrote: post #27
jacob019 wrote: post #22

It seems that this is only an issue if there is a malicious actor present on the remote network. I've always considered VPN services to be snakeoil, and this doesn't really seem like a problem with VPN technology at all. If you are connecting to an untrusted network, then you are at risk. This has always been true. From the VPN service providers perspective, can't this be mitigated by blocking direct traffic between…

> It seems that this is only an issue if there is a malicious actor present on the remote network. As I understand it, the problem comes not from the remote network provided by the VPN, but by the local network - the physical link over which the user accesses the Internet.

eg. malicious wifi hotspot

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#33

Post by rokkitmensch »

51Cards wrote: post #23
fxtentacle wrote: post #21

"there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android" I guess it really is the year of the Linux desktop :)

Sadly, I've read similar comments for 10+ years now and yet, here we still are.

Don't worry: Apples desktop quality is degrading so quickly it will be The Year of Linux on the Desktop by the end of the decade!

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#34

Post by coldtea »

fxtentacle wrote: post #21

"there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android" I guess it really is the year of the Linux desktop :)

So, it sounds like something that can be trivially implemented just as well on Windows, macOS, iOS, and xBSD?

If Linux can do it, why not the others?

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#35

Post by agwa »

bscphil wrote: post #30
agwa wrote: post #20

Earlier quoted context omitted.

Yes, namespaces are the gold standard solution.

In addition, wg-quick appears to use the rule-based solution with multiple tables by default. As I understand it this should make Wireguard (with wg-quick) users on Linux immune to this attack. My default route sends traffic to my gateway, not my VPN: default via dev host0 proto static So there's nothing for an attacker to do here. They could make themselves my gateway perhaps, but the `ip rule` would still send my t…

In general, rule-based solutions are good if they use fwmark, but this gives me pause:

> And finally we add a convenience feature for still accessing the local network, whereby we allow packets without the fwmark to use the main routing table, not the WireGuard interface's routing table, if it matches any routes in it with a prefix length greater than zero, such as non-default local routes. [https://www.wireguard.com/netns/#improved-rule-based-routing]

Doesn't that completely neutralize the protection against a DHCP server sending malicious routes or a gigantic subnet mask?

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#36

Post by jacob019 »

bscphil wrote: post #27
jacob019 wrote: post #22

It seems that this is only an issue if there is a malicious actor present on the remote network. I've always considered VPN services to be snakeoil, and this doesn't really seem like a problem with VPN technology at all. If you are connecting to an untrusted network, then you are at risk. This has always been true. From the VPN service providers perspective, can't this be mitigated by blocking direct traffic between…

> It seems that this is only an issue if there is a malicious actor present on the remote network. As I understand it, the problem comes not from the remote network provided by the VPN, but by the local network - the physical link over which the user accesses the Internet.

Ah, thanks for explaining. So this is only an issue if there is a malicious actor present on the local network. I would say that you are already compromised at that point. Say you are using public WIFI, a VPN service is pointless, you already have an anonymous public IP. Anything sensitive is encrypted end-to-end. And most public WIFI has client isolation. I suppose it could be a problem in certain countries, if your ISP can find out that you're visiting banned sites with a VPN.

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#37

Post by 999900000999 »

51Cards wrote: post #23
fxtentacle wrote: post #21

"there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android" I guess it really is the year of the Linux desktop :)

Sadly, I've read similar comments for 10+ years now and yet, here we still are.

Do we want Linux going mainstream?

Do you want every distro turning into Ubuntu with cloud services and telemetry all over the place ?

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#40

Post by flufluflufluffy »

Not my area of expertise — can somebody clarify if the DHCP server runs on your router, or your local machine? The article keeps mentioning it needs to be on the “same network” but the graphic seems like it’s all on one device.

edit: ahh I’m dumb, it’s the router (correct me if I’m wrong!). So as others have said, you have to already be on a compromised network, yes?

Post reply on HN