TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak (CVE-2024-3661)
TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak (CVE-2024-3661)
We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
Good summary by another user in the crosspost over in !programming@programming.dev:
Pretty rough and clever. Probably used in espionage for some time now. Sounds like static addresses and network namespaces solves for most of the problem though.
Yeah. Easy to check and get around this. Check your routes before transmitting data, also set up your VPN to push /2s if this relies on /1s, nuke extra routes, etc.
Novel idea though that most people wouldn’t think to look for, but at the end of the day any system will follow its routing table.
also set up your VPN to push /2s if this relies on /1s,
I don't think this is a smart way to mitigate this because it could easily result in an arms race. Push /2s, the attacker will switch to /3s; push /4s, the attacker will switch to /5s, etc. Every +1 is going to require doubling the number of routing table entries.
That can't continue forever, obviously, but it's going to result in a negative experience for the user if the VPN client has to push hundreds or thousands of routes to mitigate this attack.
The fancy transition for every single paragraph as you scroll is unnecessary and distracting.
breaking news: researchers discover that network protocols work as intended. mindlessly connecting to an untrusted network is still a bad idea.
to quote the article: "Do not use untrusted networks if you need absolute confidentiality of your traffic" or use HTTPS and a SOCKS5 proxy