Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Novel attack against virtually all VPN apps neuters their entire purpose

arstechnica.com

Post reply on HN
Print view View original

71–77 of 77 posts

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#71

Post by Zuiii »

anthk wrote: post #48
999900000999 wrote: post #37

Earlier quoted context omitted.

Do we want Linux going mainstream? Do you want every distro turning into Ubuntu with cloud services and telemetry all over the place ?

As long as Trisquel, Hyperbola or Guix exist, who cares.

> who cares.

Oh most of us will definitely care once linux developers start targeting the Ubuntus instead of the Trisquels (like how developers now target "android" instead of AOSP). I mean just look at how Gnome behaves now that it is the default DE.

A truly mainstream distro would be the death of the Linux desktop. I hope that year never comes.

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#72

Post by M95D »

TLDR explanation:

- User connects to an untrusted network (public wifi).

- That network uses DHCP to assign IP address for the user.

- A malicious DHCP would push static routes via DHCP that are more specific than a common default route, and send traffic via a malicious gateway.

- User connects to his/her VPN thinking his/her traffic is secured over the insecure network.

- The malicious static routes, being more specific, take precedence over the default route added by the VPN.

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#73

Post by anthk »

Zuiii wrote: post #71
anthk wrote: post #48

Earlier quoted context omitted.

As long as Trisquel, Hyperbola or Guix exist, who cares.

> who cares. Oh most of us will definitely care once linux developers start targeting the Ubuntus instead of the Trisquels (like how developers now target "android" instead of AOSP). I mean just look at how Gnome behaves now that it is the default DE. A truly mainstream distro would be the death of the Linux desktop. I hope that year never comes.

As long as the code is libre, the Ubuntu LTS releases will perfectly map the Trisquel ones.

Today, if some service needs propietary code, it's doomed to rot.

For firmware with desktop users and programmers/devops using Ubuntu at work -not an issue on servers- , it's preferable to use the Xanmod kernel with Trisquel than falling into thw whole cascade of propietary code in Ubuntu.

At least nonfree firmware it's a non burnt hardware ROM; that setup it's 90% free according to the FSF values. Also, you don't get overlayed taxing crap as snaps.

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#74

Post by dspillett »

djbusby wrote: post #24
dspillett wrote: post #17

Earlier quoted context omitted.

> You basically have to trust everyone on the remote LAN to not More than that when connecting via WiFi as almost everyone on a laptop does these days: you have to be careful of “evil twin” attacks from random APs nearby. Though if you are accessing a VPN to get access to internal network resources, and someone uses this hack to redirect you, you are not going to see those resources anyway and you'll know something i…

When I connect on SSH it verify the host-key. So, that would warn before submitting user/pass (but also, user-key should be used)

If doing SSH properly, yes.

Though for new hosts people often don't verify the initial host key at all, just blindly accepting it, so that would be an extra risk vector.

Heck, I'm sure many don't bother verifying a new key when they get the warning, instead just removing the old from .ssh/known_hosts (or equivalent) to quiet the complaining! Though to be honest, with that security posture nothing is going to save them and our efforts are better spent securing others! I know at least one of our clients has automated systems that ignore key changes, because we once had a temporary config cockup that sent some connections to a host with the wrong key and some data was received there without any reported issues…

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#75

Post by dspillett »

prmoustache wrote: post #6
avsteele wrote: post #5

So every company who uses VPNs to allow their people to get into the network from offsite (customer site, airport, hotel) now can't safely? You basically have to trust everyone on the remote LAN to not act like a malicious DHCP server. Reading the other thread, this wouldn't even be just the gateway.. Sounds bad!

On the other hand, it is fairly easy to obtain an ip, change your config to static ip reusing same ip, then and only then connect to the VPN.

“Fairly easy” for those of us with a technical background. I'm not volunteering to explain that to the CEO when he hears about this and asks how he can access internal company resources safely while mobile!

Re: Novel attack against virtually all VPN apps neuters their entire purpose

#77

Post by felixg3 »

mycall wrote: post #16
agwa wrote: post #2

I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blog/post/hardening_openvpn_for_def_co... (under "Attacks on redirect-gateway") It's really hard to make a robust VPN.

How hard is it for a firewall to block option 121 (and 33)? Cloudflare WARP made a robust VPN but is not cheap.

Cloudflare Warp is free, I think - if you create a Zero Trust Organisation for free and configure the Warp client to use it, you can use unmetered Warp+ with Argo routing without charge.
Post reply on HN