Many top VPN apps can be hacked and almost completely destroyed by this attack

Cybersecurity researchers at Leviathan Security have highlighted a potentially major security risk associated with VPN services.

The team recently uncovered a vulnerability that forces almost all such apps to send and receive traffic outside the VPN tunnel, which is essentially their only purpose.

The findings on the vulnerability, called TunnelVision, were published in a blog post, which also states that there is currently no clear solution to the problem. Additionally, it is claimed that the vulnerability has existed since at least 2002 and it is highly likely that hackers have already found it and exploited it in the wild.

Tunnel vision

According to the blog post, if the attacker has control of the network the victim connects to, they can configure the DHCP server that assigns IP addresses. Malicious entities connecting as unprivileged users can also set up their own DHCP server, resulting in the same result.

This feature is called “Option 121” and allows the server to gain priority over the standard routing rules that send VPN traffic through a local IP address that triggers the encrypted tunnel. Consequently, all travel data goes to the DHCP server itself, is not encrypted by the VPN and is visible to the attacker.

VPN apps that run on most major operating systems today are all vulnerable, the researchers said. You have observed a workaround and found a solution for Linux. However, mitigation opens up the possibility of a side-channel attack, which in itself is a major vulnerability.

Removing DHCP support is also not a solution, “as this could disrupt internet connectivity in some legitimate cases,” they added. “Our strongest recommendation is that VPN providers implement network namespaces on operating systems that support them,” the researchers concluded. Android is the only operating system that is not affected by this error as it does not initially implement option 121.

Related Posts

School district sues employee for alleged sexual harassment of students

Trespassing charges dropped against 79 people arrested at UT protest

Denton man arrested for murder of ex-girlfriend – Cross Timbers Gazette | Southern Denton County | Flower Hill