New Attack on VPNs

This attack has been feasible for over two decades:

Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering.

TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then.

[…]

The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself.

Tags: cyberattack, VPN

Posted on May 7, 2024 at 11:32 AM • 52 Comments

Comments

Aaron • May 7, 2024 11:48 AM

As much attention as this is getting; it’s a rather pathetic attack vector which is easily controlled… so why is this getting so much attention?

John Wythe • May 7, 2024 12:03 PM

It is getting a lot of attention because new security “experts” don’t read 3-digit RFCs anymore
/s

On a more serious note however, maybe this explains the big focus recently on getting access to the ISP home routers (or “boxes” as we call them in France)

Getting access to an ISP consumer box permits a whole lot of shenanigans, of witch this abuse of option 121 is only one example.

echo • May 7, 2024 12:20 PM

Most VPN to the best of my knowledge at the consumer level is bought on the basis of changing geolocation or lightly concealing traffic type and content from an ISP. It doesn’t need to be bullet proof just good enough to thwart consumer grade providers. Ditto most hum drum business stuff. The problems start creeping in when it involves valuable IP which can shift the future of industries or people dying. It’s not always going to be the usual big ticket military. It can be vulnerable persecuted minorities too.

The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself. Researchers from Leviathan Security explained:

Okay, change defaults or block option 121.

Interestingly, Android is the only operating system that fully immunizes VPN apps from the attack because it doesn’t implement option 121. For all other OSes, there are no complete fixes. When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks. Network firewalls can also be configured to deny inbound and outbound traffic to and from the physical interface. This remedy is problematic for two reasons: (1) a VPN user connecting to an untrusted network has no ability to control the firewall and (2) it opens the same side channel present with the Linux mitigation.

Okay, block option 121.

Doesn’t effect (verified) trusted networks.

As for Microsoft? Sheesh.

I know people don’t like my position but if you don’t like dead people then fix it. If it’s not fixed I’m going to assume people don’t care. If you don’t care then find a job in another profession.

Anonymous • May 7, 2024 12:50 PM

Not sure that these are fundamentally new research findings, though the authors may not be making that strong a claim.

E.g. from 2015:

“However, a DHCP server can also push its own routes (called “classless static routes”) to the DHCP client. So a rogue DHCP server can push routes even more specific than the OpenVPN routes, such as for 0.0.0.0/2, 64.0.0.0/2, 128.0.0.0/2, and 192.0.0.0/2. These routes cover the entire IPv4 address space, and take precedence over the less-specific OpenVPN routes.”

https://www.agwa.name/blog/post/hardening_openvpn_for_def_con

jm • May 7, 2024 2:10 PM

Some enterprise VPN clients (ZScaler) also modify routing policy using “ip rule” and their rules take precedence before the regular routing table, so this attack may be limited use.

Anonymous • May 7, 2024 2:23 PM

Does anyone know whether ProtonVPN and AirVPN are affected by this?
These are my primary, and secondary, VPNs of choice.

lurker • May 7, 2024 2:46 PM

@Bruce

This might look like a new attack on VPN, but in fact it’s an old attack on DHCP. It also assumes access to the LAN that the VPN client is on (as mentioned in the arstehnica comments: coffee shops, free wifi, &c.) The attack is against VPNs used for evading geolocation where all traffic is routed through the VPN.

It seems that this attack should not work against a WorkFromHome VPN that is configured acording to this option described by Leviathan:

3. The VPN client optionally runs a startup script to configure the host. It may configure routing rules, the DNS server to use, host-based firewall rules, or other settings

https://www.leviathansecurity.com/blog/tunnelvision

Aaron • May 7, 2024 3:03 PM

@Anonymous

ProtonVPN user here.

From what I’ve read in the original publication and additional online discussions, it’s not primarily about what VPN service you are using, since the attack happens before the VPN process.

It’s a man in the middle type attack that inserts a snooping function between your device and the VPN connection. When your device reaches out to the VPN service to create a secure connection, a fake DHCP service or a compromised legitimate service, intercepts the request and passes on it’s own IP to the service then returns the received acceptance token to your device. Your device “looks secure” but there is now a snooping device sitting inside your VPN tunnel.

The biggest weakness with this type of attack is it generally requires physical access to your local network in order to place a rogue DHCP appliance. Additionally it could come from malicious access to a device on your network that can be compromised with the DHCP spoofing software.

For perspective, the publication was setup in a perfect lab situation, not in the real world. Though I would like to see real world attempts, just to validate the risk of the attack.

Andy • May 7, 2024 3:54 PM

So at a minimum, accessing VPN in an internet cafe is practically insecure

Jacobson • May 7, 2024 4:04 PM

@Aaron

Do you perceive public hotspots as risks? Or are they considered lab environments? Typically, VPNs are utilized in such public networks without prior knowledge of whether a malicious attacker is present or not.

echo • May 7, 2024 4:13 PM

Instead of talking about it is anyone going to fix it? If the hours put into talking were put into fixing it would be fixed by now.

Or is this one of those things where Microsoft et al get to ship dodgy product then soak $20 billion off the top of the GDP to sell security products? I think I just answered my own question…

JonKnowsNothing • May 7, 2024 4:46 PM

All

A secondary by product of the VPN failure is the terminal end of the connection. If the destination is equally insecure, the VPN feature is not of much help. If you are posting on social media due to an embargo of one sort or another, the destination site is a give away.

MSM reports (note: VPN may not have been an issue, they probably didn’t even have the option)

3 sisters traced by social media by the Saudi Arabia authorities. 1 received 11 years for “terrorism” offenses, 1 has an open arrest warrant with a no-travel no-exit ban from Saudi Arabia, 1 managed to escape from the Saudi authorities. (1a, 1b)

Manahel Al-Otaibi, who was sentenced in a secret hearing before the
counter-terrorism court, was found guilty of charges related to a
Saudi anti-terror law that criminalises the use of websites to
“broadcasts or publishes news, statements, false or malicious
rumors, or the like for committing a terrorist crime”.

… a police officer who, in 2019, had tracked her down and fined
her for public indecency after she had posted a video on her
Snapchat account, showing her dancing in jeans and a baseball
cap at a concert in Riyadh. She and her two sisters, Maryam and
Manahel, had become targets in a campaign of arrests, threats and
intimidation by the Saudi authorities after they had used their
popular social media channels to post about women’s rights. For
her, the dancing clip wasn’t a political statement; it was just about
sharing a happy moment with her followers

The VPN is a perfect target for MITM and the LEAs globally are scanning public media and forums.

re: Q: is anyone going to fix it?

A: No. It is not fixable.

===

1a)

HAIL Warning

ht tps:/ /ww w.theguardian.com/world/2024/may/01/manahel-al-otaibi-saudi-arabia-womens-rights-activist-sentenced-11-years-prison-anti-terrorism-court

Saudi Arabia activist sentenced to 11 years in prison for ‘support’ of women’s rights

1b)

HAIL Warning

htt ps://ww w.theguardian.com/global-development/article/2024/may/07/family-three-sisters-saudi-arabia-fawzia-manahel-mariem-al-otaibi

‘They’ve destroyed us because of some tweets’

echo • May 7, 2024 5:20 PM

re: Q: is anyone going to fix it?

A: No. It is not fixable.

Then how come the attack fails if option 121 is blocked client side i.e. “fully immunizes them from the attack”? It seems pretty fixable to me. Of course if the whole stack is barfed then redo the protocol. Or is this another see you in ten years thing where we get to see it recycled again?

I’m more and more convinced human rights and equality is way better than any technical solution, and making international law mean something. It just heads off so many problems before a technical response it required it’s not funny.

No really anonymous • May 7, 2024 5:29 PM

On linux you can use network name spaces and a wireguard tunnel to prevent this. The local wireless network device is only visible to wireguard which connects to a fixed IP address and the dhcp client. This traffic can be locked down pretty easily. Everything else only sees the wireguard network device and that is the only way out for that traffic. The encrypted traffic can be blocked, but the plain text packets can’t be seen until after they reach the other end of the wireguard tunnel.

Ray Dillinger • May 7, 2024 5:30 PM

So, the “fix” for this MITM is to be using a statically allocated IP address that you don’t get from a DHCP server.

But that isn’t the way we’ve trained modern people to expect to be able to use the Internet.

The man-in-the-middle remains unfixable for users that don’t already have encryption keys for each other on their machines when they start. If they’re using a key server, they’re using a potential vector of attack.

lurker • May 7, 2024 6:44 PM

@echo, @Ray Dillinger

It doesn’t need fixing because it ain’t broke. At least it ain’t broke for those of us who use the internet safely. The callous solution is to leave the others to die. But since @echo wants to make a human rights case of it, what should be done with people who insist on doing VPN stuff over public wifi hotspots? The social engineering of this was sorted years ago at DefCon and 3C. This attack is against people who’ve never heard of DefCon or 3C.

The technical fix was also in years ago: Option 121 was always a fudge, always to be avoided. Decent VPN clients will know what their local network should look like, and will refuse to connect via DHCP servers that are not approved. If this means State Secrets can’t be read/written at random coffee shops, who loses?

JonKnowsNothing • May 7, 2024 8:48 PM

@lurker, All

re: State Secrets can’t be read/written at random

A MSM report that M$ is prepping an AI chatbot for spies:

Air-gapping GPT-4 model on secure network / an AI supercomputer in Iowa (1)

The idea is that is has no direct connect to the internet, yet the folks connected to the system can “feed it whatever they want”.

Having a LEA HAIL dedicated system is just as prone to HAIL as any non-dedicated HAIL system. Since it’s “State’s Secrets”, AI will just “make up stuff” based on State’s Secrets and whatever fluff they add in (~Pokemon?).

It’s claimed to be air gaped, but we already know how that DN-WAI.

Since our Happy LEAs will be putting State Secret Queries, random retrieval will be coughing up stuff from different levels of classification.

The only difference between Random Retrieval and HAIL Response, is HAIL will write paragraphs suitable for presentation to FISA Courts.

Maybe they can use it in M-A-L for entertainment.

===

HAIL warning

ht tps:/ /ars technica.com/information-technology/2024/05/microsoft-launches-ai-chatbot-for-spies/

AI chatbot for spies
Air-gapping GPT-4 model on secure network won’t prevent it from potentially making things up.

Robin • May 8, 2024 3:43 AM

@lurker; All
“If this means State Secrets can’t be read/written at random coffee shops, who loses?”

I am an interested but naive user of VPNs. When travelling I am often obliged to use “random coffee shops” (also airports, hotels, public hotspots, etc) to do banking. On a planetary scale this is small beer, of course, but for me it’s a big deal. I use a VPN in the hope of being a bit more secure when I’m sending sensitive data to my bank.

But coffee shops (and the rest) seem like ideal places to get physical access to the LAN.

(and BTW are banking apps without VPN more secure than browser + VPN?)

loon • May 8, 2024 3:49 AM

@JonKnowsNothing – ‘LEA HAIL’, what does that mean (and what does the ‘HAIL warning’ mean)?
‘LEA’ is probably Law Enforcement Agencies, if i read the context right, but ‘HAIL’? ‘Hydro Acoustic Information Link’ ? ‘Honesty, Authenticity, Integrity and Love’ ?

Wind • May 8, 2024 4:01 AM

Mullvad is immune to this attack and the previous TunnelCrack
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

echo • May 8, 2024 6:39 AM

Mullvad is immune to this attack and the previous TunnelCrack
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

What was bothers me is lack of documentation for best practice and systems not being guaranteed to be safe and that consumer level people cannot tell simply from staring at a VPN whether it is secure or not. There’s also no accessible conformancy test. This rather proves my point.

Nuking client side support for option 121 would fix that unless there’s any reason why not. Like if it’s not needed and there’s no real world backward compatibility reasons for it why is it still there? If it has to be there can’t be be made an explicit request to turn it on and, yes, I know there are problems with that too but if it is a problem you have bigger worries.

Ordinary people may rightly be concerned about things like banking. For LGBT people living in places like Iran, Uganda, and Russia et al they have to worry about loss of being able to exercise fundamental rights or jail or a death sentence. More broadly blind people regularly have accessibility problems. Again, this comes back to best practice, reference code, and comformancy tests preferably being baked into toolchains. If vendors don’t take human rights seriously from step one you end up with problems later.

Not really anonymous • May 8, 2024 7:35 AM

If you are in a ruthless country, using a VPN is a good way to get yourself tortured regardless of whether or not you have some packets rerouted without encryption.

Anonymous • May 8, 2024 8:57 AM

@Aaron

Ahhhhh!! Thank you for the summary. I got lost in the original write up.

If it’s a man in the middle attack that requires physical access to your network, then I am not too worried. An attacker with that kind of capability is typically a state actor. I use my ProtonVPN/AirVPN for other reasons (for example avoiding Google’s surveillance).

The only way I see to meaningfully protect against state actor threats while navigating online is using the TOR network.

Thanks again for the detailed summary!

Jay • May 8, 2024 9:36 AM

I’m kinda mystified as to how this is supposed to work if my VPN has pre-shared keys and a pre-shared HMAC. Anything that leaves my network is supposed to be encrypted with those secrets. Even if the DHCP server provides a bogus gateway/route, my packets are supposed to be encrypted on the way through…

What am I missing here?

Echo of past arising • May 8, 2024 9:46 AM

@Anonymous

“If it’s a man in the middle attack that requires physical access to your network”

It’s not, it’s wider than that.

What @Aaron should have said is “get on the channel” where plaintext is.

The simple attack requires what is in effect “local access” be it “to the wire” or via Wifi or in some cases over other radio based protocol. But also any upstream router between you and the VPN system.

As @Clive Robinson says every so often, it’s to do with security and communications end points.

Put simply at any point their is plaintext the system is vulnerable.

But remember there is more than one sort of plaintext…

Think about what @Clive Robinson calls the “root of trust” or “shared secret” that is in this less general case the “Session key transfer protocol” between the user client machine and the VPN server. There is a well known “race condition” on the network that goes back way before the,

“because new security “experts” don’t read 3-digit RFCs anymore”

That @John Wythe mentions with a sarcasm flag above, that allows the key exchange to be easily MITM’d

Before you ask I should say a variation on the old joke of,

“I could tell you but then I’d have to kill you”.

In that I’m more concerned that some would lynch me verbally not you 😉

More seriously it’s a way way broader class set of attacks than most realise.

At the end of the day, most “on-line” security services suffer from this “get at the plaintext” attack at the key exchange layer or higher. The simple fact is nearly all services that do some form of session key exchange are vulnerable, the pretence that CA Pub-Key will solve it, is well a “pretence”.

Aaron • May 8, 2024 10:23 AM

@Anonymous

Glad it helped.

@Jacobson did bring up an angle I didn’t consider since I don’t use it often; the unsecured networks of hotels, coffee shops, banks, etc.
These are easier attack vectors since the standard employee of these locations isn’t a network guru who knows if they have a rogue DHCP client on their network.
If I do travel I use my HooToo router between me and the hotel network.

JonKnowsNothing • May 8, 2024 11:43 AM

@loon, All

HAIL = Hallucinating AI Languages / the common output of AI responses are: not-truthful / AI systems “hallucinate” responses to queries / Marketing & PR attempt to minimize these faux outputs by using NUDGE words

HAIL Warning = the possibility of input from HAIL systems cannot be discounted

LEA = Law Enforcement Agency

LEO = Law Enforcement Organization

3L = 3 Letter Agencies, especially those that use surveillance. Global in scope. examples in USA are NSA, FBI, CIA.

NUDGE (1) = a method of subtle manipulation of opinion, choice, viewpoints. Used extensively in Marketing, PR by many corporations. Used as major driving points for High Tech companies in creating illusion of “want / use”.

====

h ttps ://en.wi kipedia.org/wiki/Nudge_theory

Nudge theory is a concept in behavioral economics, decision making, behavioral policy, social psychology, consumer behavior, and related behavioral sciences[1][2][3][4] that proposes adaptive designs of the decision environment (choice architecture) as ways to influence the behavior and decision-making of groups or individuals.

echo • May 8, 2024 12:11 PM

This is a stretch even for me!

Current AI lacks self reflection and awareness so I just view it as a verification problem. Nonsense variables in break the model which is another set of problems.

Nudge theory is unethical and doesn’t work. In my opinion nudge theory is more of a crutch to support bad actors confirmation biases. In practice it’s also allowed some dodgy people into the decision loop. Overall nudge theory seems like an exercise is “authority washing” and a good earner for those who are able to sell it as a product. Not so much for people on the receiving end of people who use it. See also: standards of conduct and human rights.

I’m personally more interested in the decision making and ecosystem which allows the kind of fixable problem which is the subject of the topic to languish. I have my suspicions. It’s a bit like why economics as a field has erased equality. A level of empathy and society goes missing in some rote learned rules based fields. People might get shouty if I prod that one.

Who knew option 121 could be so interesting!!!

JonKnowsNothing • May 8, 2024 12:12 PM

@Anonymous, All

re: I use my ProtonVPN/AirVPN for other reasons (for example avoiding Google’s surveillance).

The only way I see to meaningfully protect against state actor threats while navigating online is using the TOR network.

None of this is “secure”. In many ways, it simply marks you as a “target of interest”. The promise is “perfect security” but this is extremely hard to achieve and nearly impossible using “off the self kit”.

It maybe you do not need “perfect security” and “some security” will do. The evaluation depends on:

If your security fails: what is your risk?

If you travel, and login from a foreign country, your data packets are going through that country’s network. What happens to your data, depends on their laws and their 3Ls, LEAs.

RL tl;dr

Before the recent update to the FISA laws, the 3Ls had to do an end runaround to collect data on people inside the USA. FISA authorizes collection of FOREIGN data. The new laws now allow full collection of USA data without doing the runaround, but that’s still in place.

If you are a US Citizen visiting Paris for the Olympics, your data is FOREIGN and fully collectable.

The runaround method of collection:

* Data packets on USA networks are rerouted up into Canada where they do a loopback into the US. As the data packets are now “originating” in Canada both sides of the exchange can be collected.

Your security is only as good as your endpoints and that fails as it crosses many internet boundaries. In the USA the entire internet backbone is On Tap. In other countries their entire backbone are On Tap by their 3Ls, LEAs.

The 3Ls are not stupid. They know how to salt the battlefield. Getting an un-hacked clean version of any software and keeping it from compromise is no trivial task.

They also know how to re-flash your device and repackage it for delivery in a way that you cannot tell the device was ever opened or altered.

There are a lot of attack surfaces and many ways of exploiting them. The 3Ls hope you remain “confident” you have your security ducks lined up in a row.

Something as simple as swiping your laptop from under your nose after you log in, is all it takes.

They also expect, you won’t change your behavior because your on-line destination is where you want to be. Perhaps you have to be there, perhaps not. But your destination says a lot about why they might be interested.

Echo of past arising • May 8, 2024 12:48 PM

@echo

What does,

“Current AI lacks self reflection and awareness so I just view it as a verification problem.”

Have to do with the subject of this thread?

Likewise,

“Nudge theory is unethical and doesn’t work.”

But you further say,

“I’m personally more interested in the decision making and ecosystem which allows the kind of fixable problem which is the subject of the topic to languish.”

What if I were to tell you the problems behind the class of attack that the instance this thread is discussing are basically unfixable?

It started for what were historical resource limitations, but are still here effectively fifty years later. Because there will always be better resources outside your network perimeter than within it hence the class is bigger than that covering DDoS attacks.

Winter • May 8, 2024 12:55 PM

@All

Maybe this attack was used in the eavesdropping of German military:

A German military officer used an unsecured line for a conference call. Russia hacked and leaked it
‘https://apnews.com/article/germany-russia-ukraine-leaked-audio-taurus-98ba4fe85caf7d29902691f543a4dd04

A German military officer used an unsecured phone line at a Singapore hotel to join a conference call that was hacked by Russians and leaked to the public, Germany’s defense minister said Tuesday.

lurker • May 8, 2024 2:03 PM

@Robin, @Anonymous

Coffee shops may offer “free” wifi, but they do not offer free security. Security is hard. As others have noted, this is a MITM sttack. It may mean doing some packet sniffing before connecting, and if you see two DHCP servers on the same subnet, choose to go someplace else.

@Jay

That was my understanding too, with pre-shared keys and HMAC whatever comes out of your device should be encrypted. Phoney gateways could still be a concern for post facto cracking of your traffic.

@ALL

This attack does not seem aimed at those using well prepared point-to-point VPN. It is going for those hiding from Google, those doing banking at the hotel, dumb German military, and the people @echo worries about. For all of them VPN may be the problem, not the solution.

JonKnowsNothing • May 8, 2024 3:32 PM

@All

re: Not even camouflage will help

A MSM report of police surveillance operation in Northern Ireland against journalists who wrote unfavorable articles about the PSNI. (1)

[2011, ~2017] covertly surveilled a group of journalists on a six-month rolling basis because they were conducting unwanted investigations into the force

Another MSM report of police use of encrypted programs to avoid scrutiny and limit evidence trails. (2)

[USA, current] Georgia’s deputy attorney general said in court that he didn’t think police in the state were using Signal to communicate about the law enforcement training center colloquially known as “Cop City” – despite being presented, in a motion from defense attorneys, with evidence from the Guardian of law enforcement leadership ordering officers to download the encrypted phone app last year for that very purpose.

Both examples show that LEAs, backed by 3Ls have advanced methods of compromising security and for hiding their actions from the courts.

The key to the CopCity statement is

Georgia Deputy Attorney General John Fowler

* said in court that he didn’t think police in the state were using Signal

* he thought only federal agencies collaborating with the Georgia prosecution used Signal

If your security is doorbell level, it’s not much of a solution. It might make you feel safer but the real level of security is near-NIL. Getting security at 3L level is a very high hurdle.

What is your risk when it fails?

===

HAIL Warning

ht tps:/ /ww w.theguardian.com/uk-news/article/2024/may/08/northern-ireland-police-spied-on-investigative-journalists-tribunal-told

Northern Ireland police spied on investigative journalists
Secretive hearing learns of [Police enacted] ‘defensive operation’ carried out by PSNI in attempt to identify sources
2011, 2016, 2017 (undetermined other time frames)

HAIL Warning

ht tps:/ /ww w.theguardian.com/us-news/article/2024/may/08/signal-app-cop-city-georgia

[USA] Georgia claims police not using Signal to message about ‘Cop City’, despite evidence to contrary

CopCity is a controversial development that converts a public park and woodland into a dedicated police urban warfare training Potemkin Village where many police agencies and international policing groups can come train for large scale urban house-to-house find-attack-kill warfare scenarios.

Mr. X • May 8, 2024 5:24 PM

FWIW, IVPN.net tech support offers their take on its customers’ options: https://www.reddit.com/r/IVPN/comments/1clwlup/tunnelvision_vulnerability/

Long story short, the Android IVPN app is not affected. The iOS app is vulnerable. The desktop apps have a default firewall functionality that blocks all traffic going outside the VPN interface. The obvious options are detailed at the link.

This security issue does not worry me because I mainly use the Mac desktop and iOS apps on my home network. I cannot recall the last time I used public WiFi; probably in 2009 when I visited Amsterdam. 😉

echo • May 8, 2024 8:06 PM

This attack does not seem aimed at those using well prepared point-to-point VPN. It is going for those hiding from Google, those doing banking at the hotel, dumb German military, and the people @echo worries about. For all of them VPN may be the problem, not the solution.

I assume everything with a plug on it is compromised. If it’s not one actor poking their sticky beak in it’s another. It can be a case of pick your actor and risk appetite.

GCHQ don’t care about your bank app. Odds on if you’re a UK citizen they have every transaction logged and maybe the sourcecode to the app and some input into the transaction processing systems. If GCHQ/MI6 want foreign bank details it’s known they have in the past by means mysterious been able to get them on demand much to the indignation of bank management. Or they may have got lucky and bigged it up for a laugh. Hard to say, really.

Germany has a multi-generational East-German integration problem which is also driving AFD support. The legacy of Soviet brainwashing looms large. Hans-Georg Maassen, one of their former chiefs was sacked for becoming “radicalised” and a far right supporter.

If the security services want to know what I am on about they either know already or can buy me lunch if they’re that desperate to find out. Like, what do you want to know?

Being a lady of a certain age I don’t need a laptop or internet. If I traveled to any country on my do-not-travel-there list it would be as a tourist doing tourist things and visiting touristy-places. At best I would be a social observer. I’ve found it’s always people on the outside who can really influence along with social movements on the inside.

Sometimes all you have left is your own happiness. It’s a thing.

Jonathan Wilson • May 8, 2024 8:10 PM

Is it possible for a VPN app to read the routing table and warn the user if there are entries in the table that override the VPNs routing table entries?

Echo of past arising • May 8, 2024 10:05 PM

Jonathan Wilson,

“Is it possible for a VPN app to read the routing table and warn the user if there are entries in the table that override the VPNs routing table entries?”

Yes, just as the user can.

However will it be of any use?

Probably not.

Users are almost always task oriented not security oriented. @Bruce has talked about this issue in the past, and anyone who has done any kind of support be it 1st line or 3rd knows what that means…

An angry phone call from “the boss” who is away on some “business trip” in a different time zone, demanding you fix it.

It’s a “no win situation” for the support person.

So if the app has any kind of “off switch” on the functionality you know what is going to happen.

Even having obligatory “pop-ups” with “every time confirmation” won’t stop ‘task oriented’ people “clicking through” or similar “computing policy” misbehaviour.

Going as far back as 1995 there have been “on client device” VPN end nodes. They entirely took over the networking stack on the client device and forced users to only use a known single IP address at the users place of work. But even such heavily locked down systems have vulnerabilities.

There are more modern equivalents that use “virtual host networking”. In effect they create a virtual machine inside the client device and lock it down there.

But users obviously loose functionality in a secure setup, and that’s when the “three in the morning” support calls have a habit of happening…

ResearcherZero • May 8, 2024 10:45 PM

@Jonathan Wilson, @ALL

Relying on a temporary wireless hotspot controlled by a cellular device you own also effectively blocks this attack.

“They create a password-locked LAN with automatic network address translation,” the researchers wrote of cellular hot-spots. “Because this network is completely controlled by the cellular device and requires a password, an attacker should not have local network access.”

VPNs run inside of a VM are not vulnerable to this attack, provided they are not run in “bridged mode,” which causes the VM to replicate another node on the network.

Enabling leak blocking options within a VPN app may also help. Remember VPNs effectively create a LAN connection, so assume these ‘leak blocking’ options are not bulletproof.

‘https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/

WireGuard uses Namespaces which separates different “physical” adapter instances and routing tables/entries. This avoids many of the problems that plague other implementations.

https://www.wireguard.com/netns/

There are a number of ways that VPNs can leak data on Android and other operating systems.

Androids “Block connections without VPN” has an outstanding problem that leaks DNS as well.
Avoid using Androids built-in options until it is eventually patched, as this leak blocking functionality doesn’t appear to work as intended for local network multicast or for DNS when any VPN app is down. This needs to be patched upstream in Android to be fixed.

Switching server locations has also long been a problem on Android and sometimes in Windows. Connectivity checks also can leak DNS information and other metadata…

‘https://issuetracker.google.com/issues/250529027

Jan Schermer • May 9, 2024 1:54 AM

AFAIK “real” VPNs (IPsec) are not vulnerable to this because they insert policies to govern the traffic. One vulnerability those could have is if you had more than one interface with the same metric or some unusual networking setup and those policies were installed on the interface the traffic doesn’t actually go through.

And it’s sad that lack of support for a DHCP option on Android gets lauded as “not vulnerable”.

Robin • May 9, 2024 3:12 AM

@echo

“GCHQ don’t care about your bank app. Odds on if you’re a UK citizen they have every transaction logged … ”

I assume that any state actor can get what they want from or about me, but I doubt that they want to waste time on a nobody like me (unless it’s a case of mistaken identity). No, protecting my financial transactions in suspect coffee shops is more about the organised scoundrels who would be very happy to fillet my bank account and spend freely using my data.

JonKnowsNothing • May 9, 2024 5:25 AM

@Robin, All

re: I assume that any state actor can get what they want from or about me, but I doubt that they want to waste time on a nobody like me

You are exactly the person they are looking for. Not because of something you did or didn’t do but because you are a link in chain that leads to someone else.

Six degrees of separation is the idea that all people are six or fewer social connections away from each other. As a result, a chain of “friend of a friend” statements can be made to connect any two people in a maximum of six steps. It is also known as the six handshakes rule.

For LEAs and 3Ls, the practical target is 3 or 4 handshakes from any starting point.

It isn’t about who you know, it’s about who you do not know that you know

This factor is not just done by the CIA and NSA. Every country that has any medium sophisticated system has access to such connections, either by their own capture systems (license plate readers) or purchasing data from an aggregator or by purchasing a software system with a ready-built dataset.

====

ht tps: //e n.wikipedia.org/wiki/Six_degrees_of_separation

The idea is sometimes generalized to the average social distance being logarithmic in the size of the population.

JonKnowsNothing • May 9, 2024 6:39 AM

@long time observer, @Clive All

re: Handles and Gretels

I play PVP games and one thing you can count on is the other players changing their handles. Most game provide a mechanism for this (~$10USD) and players do it regularly.

There are lots of reasons why a player might change handles or even pick a name similar to another player. Most of it has to do with tactics while playing or distracting the other team.

Really long names, of salacious content, are common since many groups use voice conference servers to direct battle plans. Nothing funnier than directing an attack against a player who’s handle passes the profanity filter until you say it out loud.

Sometimes a player gets to sit on the Naughty Step for a while. So they roll another avatar until their main toon gets released.

There are also conditions where player’s get their accounts hacked, a very nasty problem and sometimes it cannot be fixed.

I hope @Clive is doing well. I hope he is busting his gut laughing at the stuff that rolls though some of these posts.

echo • May 9, 2024 7:42 AM

blockquote>“GCHQ don’t care about your bank app. Odds on if you’re a UK citizen they have every transaction logged … ”

Oh for sure.

While everything is always a none zero risk it’s unlikely the local hippies or feminist collective are scalping your data. A second bank account can act as a buffer. Alternatively don’t use online banking. For anything serious all contracts and payments are to be account holder present with a signature in wet ink. If anything goes wrong it’s on their insurance not yours.

Being a lady of a certain age I remember a world before the internet when things like travelers cheques and bullion and a visit to the bank existed. I still prefer visiting the bank when I have an excuse. I felt my favourite banker was destined for the top and, sadly for me, the top felt so too and they gave him his own bank. We used to enjoy our conversations and I squeezed a confession out of him he enjoyed the skive which was quite the laugh at the time. His pet name for me was “Trouble”. Who me? He was always very careful and listened closely and looked after me. I appreciate that. I just wish the bank hadn’t moved MY banker but he deserved his success and I’m happy for him. He was one of the good ones.

Security indicators come in many forms. If it feels wrong it probably is.

JonKnowsNothing • May 9, 2024 8:04 AM

@Winter, All

re: trolls and discord

The stuff I’ve heard on discord would make hair curl. It’s a fast changing pool of urban jargon and idioms and references that require a dictionary search.

While you can morph your voice, I don’t think many players bother. From the timbre of the voice most of the people in my PVP groups are adults. Adults do odd stuff. And they do odd stuff while playing games and having a pile of folks in the channel taking in the finer details of stuff.

A large percentage of the players are drugged or drunk while playing and their social restraints are “very poor”. You can learn a lot of biology from such encounters; stuff you never wanted to know about.

My game has a built in conference server. This chatter used to be common on the open comm link. Most folks migrated to other conference servers over the years and discord is the latest variation. Thankfully they took the majority of such commentary with them.

Ardie • May 9, 2024 9:04 AM

@Anonymous, @JonKnowsNothing re: your May 8, 2024 12:12 PM and re:

(using tor to…)

“protect against state actor threats”

Agreed that the situation with “off the shelf kit” is completely pointless.

Edgesuite is evidently blocking every TOR channel possibly can, as it seems from this end.

Other server players are also. And I feel sure there is a targetted attack by governmet at play here lately also.

The upshot is: Our right to communicate privately has been completely and systematically denied. Even our right to communicate at all, in some cases. Our governments have absolutely raped us in this regard. The AI’s will sue the individual players in due time, using their own black-ops methods.

Meanwhile its time to write “airgaps and exclusive routine back-channel otp comms” for DUMMIES.

Winter • May 9, 2024 11:17 AM

@JonKnowsNothing, echo

Do not underestimate the power of cooperative non-LEA searches.

Osint (Open Source Intelligence) is quite powerful. When you read Brian Kreb’s blog, or Belingcat, you can get an idea what is possible with just ingenuity and an internet connection.

echo • May 9, 2024 12:48 PM

Osint (Open Source Intelligence) is quite powerful. When you read Brian Kreb’s blog, or Belingcat, you can get an idea what is possible with just ingenuity and an internet connection.

I never read them myself. There is (some) overlap but otherwise different tribes with different goals and different tools and different methods and different skills. It’s no surprise technocentric hierarchical people in a traditionally male dominated industry can miss this. It does irk me a bit.

The OSI is less than 0.1%. There’s much more going on and that’s what interests me. I nearly but didn’t post some reports from people on the ground. Anyone here will almost certainly likely miss them or discount them. They provided me with a datapoint because I know what to look for.

It’s like the exploit mentioned in the topic. It puzzles me why it hasn’t been fixed or standard mitigations and warnings are not industry standard. I’m puzzled more when people obsess it and nothing changes while I’m more interested in the organisation and people and sense of a place where it may be located. Likewise with the demonstrations it’s not politicians or police and their ridiculous paramilitary equipment and vehicles providing security. The security is a society which prioritises the human rights and a sense of society and values.

I’m not stopping people reading Krebs or Bellingcat or obsessing tech. I’m just puzzled with their end game.

lurker • May 9, 2024 5:21 PM

@Jan Schermer

Right on. This is wrongly headlined as an attack on VPNs generally. It’s an attack on the VPNs used by people who either don’t know how to use a VPN, or don’t want to pay for a proper one.

echo • May 9, 2024 5:37 PM

Right on. This is wrongly headlined as an attack on VPNs generally. It’s an attack on the VPNs used by people who either don’t know how to use a VPN, or don’t want to pay for a proper one.

That whiffs of blaming end users for problems caused by the industry. Punch up not down.

lurker • May 9, 2024 6:39 PM

@echo

It’s a free market. People are free to choose junk so-called VPNs. Somehow that becomes a “security” problem? Isn’t it a social problem if endusers aren’t sufficiently educated to know how to get the best product for their purpose? I regard it as a social problem that so-called “leaders of industry” are free to foist vulnerable products on the public. Magic wands are not allowed.

echo • May 9, 2024 8:19 PM

@lurker

It’s a free market. People are free to choose junk so-called VPNs. Somehow that becomes a “security” problem? Isn’t it a social problem if endusers aren’t sufficiently educated to know how to get the best product for their purpose? I regard it as a social problem that so-called “leaders of industry” are free to foist vulnerable products on the public. Magic wands are not allowed.

Where you place something on the technical, human rights, social, and economic security model can get a bit wild. Depending what it is can make it hit the grid in multiple places to multiple degrees.

I prefer regulated markets, standards, best practice, reference code, conformancy tests, adequate provider due diligence, consumer protection, and so on. You don’t need to be some mega certified with a ten year learning path job title and a need for a PhD for this. Some things sure but they’re often turnkey. All the IQ was baked in before you went anywhere near it. Of course some jurisdictions can have flaky standards so…

VPN’s are what they are but they can be a patch on a laundry list of problems. The basic internet was designed that way because of another set of problems. So the question “What are you buying?” can get a bit deep.

With regard to all this I think it’s important to be client led. There are limits obviously as well as balance of expertise and expectations. Sometimes a client can know 100x what you know and it’s your job to deploy your expertise in “getting **** done” to facilitate those goals within acceptable quality/ethical etcetera parameters. Mind you some clients know naff all so there is that too.

As you push your service/product you’re going to expand your market to varying degrees of expert and inexpert people with different needs. Some stuff is foolproof. Other stuff not so. Some situations are this and other situations are that. I just think it’s beholden on the provider to be aware of this. It’s all routine until it’s not and it’s that “not” bit where you start earning your money. Then there’s all the soft skills like customer service and support and so on. Each one can hit the security matrix.

So back to your assertion it’s a social problem? Um, sure there’s a lot of weight on that one and you can use it as your sole starting point. It has a lot going for it. At the same time it still operates within and is part of the security matrix. Failure of the social can lead to the collapse of the rest.

Magic wand? No but some practical considerations which when accumulated can make a lot of problems go away, or fixing them before they get worse, or sometimes solve problems you didn’t know you had.

Mobile Phone security improvment • May 13, 2024 9:42 PM

How hard to make a mobile phone secure?

The answer is very hard (if not impossible)

But security and privacy are not the same except at one end of the spectrum line.

Privacy is a spectrum from mildly anonymous through to the start of actual security.

For most people they need a degree of privacy that stops them being “low hanging fruit” to cyber-crooks.

The principle being

“In a target rich environment attackers motivated by ‘Return On Investment’ will go for the easiest targets at any return point.”

This means that there are two things to consider

Attack cost / difficulty
Return on attack cost

This means you have two things under your control that can help make you less susceptible.

Reduce your value to an attacker
Increase attackers costs

The first as far as ‘content’ privacy is concerned is : do not do finance, online shopping or social media on your mobile phone, as all of these increase your value to an attacker.

The first as far as ‘traffic’ meta-data privacy is concerned is : prevent your traffic meta-data being observed. The usual way quoted is “use a VPN” but actually that is problematical as discussed above. However the likely hood of such an attack is based on the attackers ROI per target. For cyber-crooks currently it is very unlikely as an attack. But for repressive states and major corps that are Level III or Level II attackers the cost is spread across the community so the high setup is amortized across the community thus the ROI per individual is low. Repressive States will not care about the ROI / individual however major corps will. This means that there is a range you can in non-repressive state countries and those not doing ‘collect it all’ hoovering you can play in. The type of VPN you need to use to avoid this attack is one where

“all the end points are under the users control”

This is a subject that would take many many posts to cover. So for now it will not be considered.

Increasing the attackers costs is what encryption and VPN’s are all about. However you need

“True End to End Encryption with no over the line key negotiation.”

Some applications but by no means all do this and many if not all fail under certain conditions such as sending a message to more than one person due to not just “key / plaintext” reuse.

But mostly as a user who is just looking to keep cyber-crooks away from their door there are some things you can do, but you need to be thoughtful.

Take this online example

https://m.youtube.com/watch?v=D12e3dzkZD4

It’s a very basic indicator of what you will need to do but it’s not as thoughtful as it needs to be.

New Attack on VPNs

Comments

Leave a comment Cancel reply