116
TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak (CVE-2024-3661)
(www.leviathansecurity.com)
this post was submitted on 07 May 2024
116 points (96.0% liked)
Technology
59232 readers
4024 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Pretty rough and clever. Probably used in espionage for some time now. Sounds like static addresses and network namespaces solves for most of the problem though.
Yeah. Easy to check and get around this. Check your routes before transmitting data, also set up your VPN to push /2s if this relies on /1s, nuke extra routes, etc.
Novel idea though that most people wouldn’t think to look for, but at the end of the day any system will follow its routing table.
I don't think this is a smart way to mitigate this because it could easily result in an arms race. Push /2s, the attacker will switch to /3s; push /4s, the attacker will switch to /5s, etc. Every +1 is going to require doubling the number of routing table entries.
That can't continue forever, obviously, but it's going to result in a negative experience for the user if the VPN client has to push hundreds or thousands of routes to mitigate this attack.