This attack has been feasible for over two decades:
Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering.
TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then.
[…]
The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself.
More Stories
Friday Squid Blogging: Emotional Support Squid
When asked what makes this an “emotional support squid” and not just another stuffed animal, its creator says: They’re emotional...
Nissan reveals ransomware attack exposed 53,000 workers’ social security numbers
Nissan North America has revealed that extortionists who demanded a ransom after breaking into its external VPN and disrupted systems...
UK Councils Warn of Data Breach After Attack on Medical Supplier
Multiple UK councils have warned that residents’ personal data may have been compromised following a ransomware attack on NRS Healthcare...
How to Protect Yourself on Social Networks
There are now over 5 billion active social media users worldwide, representing 62.3% of the global population. While social networks...
New Android Banking Trojan Mimics Google Play Update App
A new banking Trojan targeting Android devices shows multifaceted capabilities Read More
FBI Seizes BreachForums Website
The FBI has seized the BreachForums website, used by ransomware criminals to leak stolen corporate data. If law enforcement has...