{"id":162894,"date":"2024-05-08T18:21:42","date_gmt":"2024-05-08T18:21:42","guid":{"rendered":"https:\/\/securityaffairs.com\/?p=162894"},"modified":"2024-05-08T18:21:44","modified_gmt":"2024-05-08T18:21:44","slug":"tunnelvision-attack-vpn","status":"publish","type":"post","link":"https:\/\/securityaffairs.com\/162894\/hacking\/tunnelvision-attack-vpn.html","title":{"rendered":"New TunnelVision technique can bypass the VPN encapsulation"},"content":{"rendered":"
<\/div>\n

TunnelVision is a new VPN bypass technique that enables threat actors to spy on users\u2019 traffic bypassing the VPN encapsulation.<\/h2>\n\n\n\n

Leviathan Security researchers recently identified a novel attack technique, dubbed TunnelVision, to bypass VPN encapsulation. A threat actor can use this technique to force a target user\u2019s traffic off their VPN tunnel using built-in features of DHCP (Dynamic Host Configuration Protocol). <\/p>\n\n\n\n

The technique causes the VPN to fail to encrypt certain packets, leaving the traffic vulnerable to snooping. The researchers referred to this result as “decloaking.” The experts pointed out that the VPN control channel remains active during the attack and users still appear connected to the VPN in all observed instances.<\/p>\n\n\n\n

The technique manipulates routing tables that used to send network traffic through the VPN tunnel. <\/gwmw><\/gwmw><\/p>\n\n\n\n

TunnelVision exploits the vulnerability CVE-2024-3661, which is a DHCP design flaw where messages such as the classless static route (option 121) are not authenticated and for this reason can be manipulated by the attackers.<\/p>\n\n\n\n

Option 121 enables administrators to incorporate static routes into a client’s routing table using classless ranges. There is no restriction, aside from packet size, on the number of different routes that can be simultaneously installed.<\/gwmw><\/gwmw><\/p>\n\n\n\n

A threat actor that can send DHCP messages can tamper with routes to reroute VPN traffic, enabling him to intercept, disrupt, or potentially manipulate network traffic.<\/p>\n\n\n\n

A local network attacker can exploit the technique to redirect traffic to the local network instead of the VPN tunnel. <\/p>\n\n\n\n

The attackers can decloak VPN traffic only if the targeted host accepts a DHCP lease from the attacker-controlled server and the targeted host\u2019s DHCP client implements DHCP option 121.<\/gwmw><\/p>\n\n\n\n

“We want to stress that there are ways an attacker who is on the same network as a targeted user might be able to become their DHCP server:<\/em><\/p>\n\n\n\n