Novel attack against virtually all VPN apps neuters their entire purpose
1–10 of 77 posts
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#2I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blog/post/hardening_openvpn_for_def_co... (under "Attacks on redirect-gateway")
It's really hard to make a robust VPN.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#3Re: Novel attack against virtually all VPN apps neuters their entire purpose
#4It's because networks/routing tables aren't really designed with security principles in mind.
If they were, it would be a simple setting to set an ACL on the network interface to say "DENY all traffic except from VPN application".
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#5So every company who uses VPNs to allow their people to get into the network from offsite (customer site, airport, hotel) now can't safely?
You basically have to trust everyone on the remote LAN to not act like a malicious DHCP server.
Reading the other thread, this wouldn't even be just the gateway.. Sounds bad!
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#6So every company who uses VPNs to allow their people to get into the network from offsite (customer site, airport, hotel) now can't safely? You basically have to trust everyone on the remote LAN to not act like a malicious DHCP server. Reading the other thread, this wouldn't even be just the gateway.. Sounds bad!
On the other hand, it is fairly easy to obtain an ip, change your config to static ip reusing same ip, then and only then connect to the VPN.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#7It's because networks/routing tables aren't really designed with security principles in mind. If they were, it would be a simple setting to set an ACL on the network interface to say "DENY all traffic except from VPN application".
You seem to be conflating routing and firewalling/access control.
You can control your routing table using standard tools (ip route add). You can have helper applications work on it, and get hints from external sources like dhcp, where you can listen to its suggestions (IP, subnet, DNS, extra routes, and other options), or ignore them.
If you take those hints then that's your choice.
With icmp redirects you can choose to allow them or not with settings like net.ipv4.conf.all.accept_redirects.
Then as a belt and braces you have iptables. If you want an ACL on the network interface to say "DENY all traffic except from VPN application", then set your input/output/forward chains to default deny and have a rule to allow from pid=$vpn_pid. I believe you can use pid in pre/postrouting chains.
Personally when I'm travelling I have rules which only allow access to my vpn targets, and from memory just DHCP and arp. Have to temporarily disable it for captive portals but then it's back on. Sometimes a network won't accept UDP, so I generally have to tether for normal response.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#8So every company who uses VPNs to allow their people to get into the network from offsite (customer site, airport, hotel) now can't safely? You basically have to trust everyone on the remote LAN to not act like a malicious DHCP server. Reading the other thread, this wouldn't even be just the gateway.. Sounds bad!
On the other hand, it is fairly easy to obtain an ip, change your config to static ip reusing same ip, then and only then connect to the VPN.
It's incredibly brittle. The more frequented a network is the shorter the DHCP leases will be, I've seen public hotspots with 10 minutes of lease time.
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#9Would isolating a Wireguard interface using namespaces as described here[0] mitigate this?
[0] https://www.wireguard.com/netns/#the-new-namespace-solution
Re: Novel attack against virtually all VPN apps neuters their entire purpose
#10Android phones running VPNs are apparently still secure. They're recommending using phone as hotspots if you can.