Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
If one is working from a non trusted network (idk, a coffee shop), isn't that true?
Novel attack against virtually all VPN apps neuters their entire purpose
41–50 of 77 posts
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#42Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
Doesn't this blow up the attack surface area to any isp and to any place that offers free wifi? With this attack, I can't assume that it's safe to bring my laptop to a coffee shop and enable the VPN.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#43Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
If one is working from a non trusted network (idk, a coffee shop), isn't that true?
I would break it down in two parts.
1. Coffee shop Wi-Fi router is compromised. Than that's a possible vector.
2. Bad actor sitting in the coffee shop and trying to carry out attack similar to the one described on the link. Fortunately that won't work on any decent WiFi infra from Meraki, Ubiquiti or similar.
DHCP attacks are always a problem on dumb wired switches though.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#44Adding routes via DHCP does nothing to my VPN that is activated by fwmark.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#45And yet another time when a strict policy of "Always Ban the OhSoCoolConvenientKludgeTech for anything that could matter" turns out to look like a genius move. :(
I don't understand your comment, can you explain? What is the "OhSoCoolConvenientKludgeTech" that should be banned in this case? VPN?
I was thinking of DHCP - though the VPN tech certainly doesn't look good either.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#46Not my area of expertise — can somebody clarify if the DHCP server runs on your router, or your local machine? The article keeps mentioning it needs to be on the “same network” but the graphic seems like it’s all on one device. edit: ahh I’m dumb, it’s the router (correct me if I’m wrong!). So as others have said, you have to already be on a compromised network, yes?
DHCP is a client-server protocol, so it "runs" both on the router (as a server program vending available IP addresses) and the local machine (as a client program initiating the request for an IP address, and ultimately accepting the given IP address from the DHCP server on the router).
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#47"there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android" I guess it really is the year of the Linux desktop :)
And yet the article goes on to say that Linux doesn't fully mitigate the issue. Confusing.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#48Earlier quoted context omitted.
Sadly, I've read similar comments for 10+ years now and yet, here we still are.
Do we want Linux going mainstream? Do you want every distro turning into Ubuntu with cloud services and telemetry all over the place ?
As long as Trisquel, Hyperbola or Guix exist, who cares.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#49Attack assumes that someone already controls DHCP. If bad actor controls DHCP you have a bigger problem.
If you dont run your network, you should assume there is a bad actor. Many wifi/router combos have a password of 'admin' or just as easy. Even if the coffee shop giving you wifi is innocent, the person that reconfigured their network in 10 seconds might not be.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#50Earlier quoted context omitted.
If one is working from a non trusted network (idk, a coffee shop), isn't that true?
I would break it down in two parts. 1. Coffee shop Wi-Fi router is compromised. Than that's a possible vector. 2. Bad actor sitting in the coffee shop and trying to carry out attack similar to the one described on the link. Fortunately that won't work on any decent WiFi infra from Meraki, Ubiquiti or similar. DHCP attacks are always a problem on dumb wired switches though.
Are there workarounds VPN clients can use to prevent this attack from working (or in the worst case, disconnect rather than send traffic outside the tunnel on a hostile network)?