“There are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android.”
So there are ways.
Hate to rain on the Linux parade here, but didn’t the article say: “There are no ways to prevent such attacks except when the user’s VPN runs on Android.” and that Linux was just as vulnerable as Windows?
So for this attack to work, the attacker needs to be able to run a malicious DHCP server on the target machine’s network.
Meaning they need to have already compromised your local network either physically in person or by compromising a device on that network. If you’ve gotten that far you can already do a lot of damage without this attack.
For the average person this is yet another non-issue. But if you regularly use a VPN over untrusted networks like a hotel or coffee shop wifi then, in theory, an attacker could get your traffic to route outside the VPN tunnel.
Put another way, this means that a malicious coffee shop or hotel can eavesdrop on all VPN traffic on their network. That’s a really big fucking deal.
Not all VPN traffic. Only traffic that would be routable without a VPN.
This works by tricking the computer into routing traffic to the attacker’s gateway instead of the VPN’s gateway. It doesn’t give the attacker access to the VPN gateway.
So traffic intended for a private network that is only accessible via VPN (like if you were connecting to a corporate network for example) wouldn’t be compromised. You simply wouldn’t be able to connect through the attacker’s gateway to the private network, and there wouldn’t be traffic to intercept.
This attack doesn’t break TLS encryption either. Anything you access over https (which is the vast majority of the internet these days) would still be just as encrypted as if you weren’t using a VPN.
For most people, in most scenarios, this amount to a small invasion of privacy. Our hypothetical malicious coffee shop could tell the ip addresses of websites you’re visiting, but probably not what you’re doing on those websites, unless it was an insecure website to begin with. Which is the case with or with VPN.
For some people or some situations that is a MASSIVE concern. People who use VPNs to hide what they’re doing from state level actors come to mind.
But for the average person who’s just using a VPN because they’re privacy conscious, or because they’re location spoofing. This is not going to represent a significant risk.
That’s a fair point, you’re right.
I do still think that a lot of people do use VPNs in public spaces for privacy from an untrusted provider, though, perhaps more than your initial comment seemed to suggest.
This is the primary reason folks use VPNs - to protect themselves on public networks. I would say it’s definitely not a non-issue.
The thing is that in most cases you don’t need a VPN to protect yourself on a public network. The ubiquity of TLS on the internet already does a great job of that. Using a VPN on a public network for privacy and security reasons amounts to little more than the obfuscation of which sites you’re visiting, and some fallback protection against improperly configured websites. So while I agree it isn’t entirely a non-issue, it definitely isn’t as big of an issue as one might assume given the scary wording of the headline and article.
I think the real meat here would be the work from home crowd. If you can find a hole in there router, you can inject routing tables and defeat VPN.
But the VPN client doesn’t have to be stupid. You could certainly detect rogue routes and shut down the network.
As I mentioned in my other comment, this wouldn’t let an attacker eavesdrop on traffic on a VPN to a private corporate network by itself. It has to be traffic that is routable without the VPN.
I don’t know, if you’ve already have full control over routing and have some form of local presence, seems to me you could do something interesting with a proxy, maybe even route the traffic back to the tunnel adapter.
I can’t see routing traffic to some kind of local presence and then routing back to the target machine to route out through the tunnel adapter without a successful compromise of at least one other vulnerability.
That’s not to say there’s nothing you could do… I could see some kind of social engineering attack maybe… leaked traffic redirects to a local web server that presents a fake authentication screen that phishes credentials , or something like that. I could only see that working in a very targeted situation… would have to be something more than just a some rouge public wi-fi. They’d have to have some prior knowledge of the private network the target was connecting to.
We’re already assuming you have something that can compromise DHCP. Once you make that assumption who’s to say you don’t have a VM hanging out.
there are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android.
So . . . unix? Everything-but-Windows?
Everything-but-Windows?
No. Any device that implements a certain DHCP feature is vulnerable. Linux doesn’t support it, because most Linux systems don’t even use DHCP at all let alone this edge case feature. And Android doesn’t support it because it inherited the Linux network stack.
I would bet some Linux systems are vulnerable, just not with the standard network packages installed. If you’re issued a Linux laptop for work, wouldn’t be surprised if it has a package that enables this feature. It essentially gives sysadmins more control over how packets are routed for every computer on the LAN.
most Linux systems don’t even use DHCP
WTF are you smoking? WTF is wrong with you that you think such a dumb claim would go unscrutinized? I would play Russian roulette on the chances of a random Linux installation on a random network talking DHCP.
Edit, in case being charitable helps: DNS and IP address allocation aren’t the only things that happen over DHCP. And even then the odds are overwhelming that those are being broadcast that way.
If your LAN is already compromised with a rogue DHCP server, you’ve got bigger problems than them intercepting just VPN traffic. They can man in the middle all of your non-encrypted traffic. While this is bad, it’s not a scenario most people will run into.
The problem isn’t them being in you LAN. It’s about going to an untrusted network (eg Starbucks, hotel) and connecting to your VPN, boom, now your VPN connection is compromised.
I woke up this morning and thought of this exact scenario, then found your comment lol
Yes, this is bad for anyone who travels for work and can’t trust the network they connect to.
I wonder if it applies to routers made by a company who likes collecting user data. Because this is a situation many people are in.
So I gave the article a glance and it’s a bit beyond me can someone give me an eli5?
My understanding is that if you run a rogue discoverable DHCP server in a local network with a particular set of options set and hyper-specific routing rules, you can clobber the routing rules set by the VPN software on any non-Android device, and route all traffic from those devices through arbitrary midpoints that you control.
But IANANE (I am not a network engineer) so please correct my misinterpretations.
(obligatory I’m not a network surgeon this is likely not perfectly correct)
The article mentions network interfaces, DHCP and gateways so real quick: a network interface usually represents a physical connection to a network, like an Ethernet port or a WiFi card. DHCP is a protocol that auto configured network routes and addresses once a physical connection is established, like when you jack in via an ethernet cable, it tells you the IP address you should go by, the range of IP address on the network you’ve connected to, where you can resolve domain names to IP addresses. It also tells you the address of a default gateway to route traffic to, if you’re trying to reach something outside of this network.
You can have more than one set of this configuration. Your wired network might tell you that your an address is 10.0.0.34, anything that starts with 10.0.0. is local, and to talk to 10.0.0.254 if you’re trying to get to anything else. If at the same time you also connect to a wireless network, that might tell you that your address is 192.168.0.69, 192.168.0.* is your local network, and 192.168.0.254 is your gateway out. Now your computer wants to talk to 4.2.2.2. Should it use the wireless interface and go via 192.168.0.254? or the wired one and use 10.0.0.254? Your os has a routing table that includes both of those routes, and based on the precedence of the entries in it, it’ll pick one.
VPN software usually works by creating a network interface on your computer, similar to an interface to a WiFi card, but virtual. It then asks the OS to route all network traffic, through the new interface it created. Except of course traffic from the VPN software, because that still needs to get out to the VPN provider (let’s say, at 1.3.3.7) via real Internet.
So if you’re following along at home, your routing table at this point might look like this:
- traffic to 1.3.3.7 should go to 10.0.0.254 via the wired interface
- all traffic should go to the VPN interface
- traffic to 10.0.0.* should go to the wired interface
- all traffic should go to 10.0.0.254 via the wired interface
- traffic to 192.168.0.* should go to the wireless interface
- all traffic should go to 192.168.0.254 via the wireless interface
whenever your os wants to send network packets, it’ll go down this list of rules until one applies. With that VPN turned on, most of the time, only those two first rules will ever apply.
If I’m reading the article correctly, what this attack does, is run a DHCP server, that when handing out routing rules, will send one with a flag that causes, for example, the last two rules to be placed at the top of the list instead of the bottom. Your VPN will still be on, the configuration it’s requested the OS to make would still be in place, and yet all your traffic will be routed out to this insecure wireless network that’s somehow set itself as the priority route over anything else.
Thank you network nurse
That actually lays it out incredibly well for me. So in practice, what would I need to look out for as a wired desktop Ubuntu user with mullvad? It’s sounding like this is going to be an issue on public networks, is this something my isp can do to me at home?
I think this is a good enough reason to actually put in some effort to phase out ipv4 and dhcp. There shouldn’t be a way for some random node on the network to tell my node what device to route traffic over. Stateless ipv6 for the win.
Efforts have been put in for several decades now
I still remember all the hype around “IPv6” day about 12 years ago…
Any day now…
Honestly I’m on a IPv6 provider (with CGNAT for IPv4-only services) and everything works fine.
I think people are just lazy.
I don’t think it’s laziness, it’s financial incentive—there’s not much demand for something that might be quite a lot of work from a lot of companies’ perspectives.
Hell, IIRC AWS only started supporting IPv6 completely on the cloud service that hosts a huge percentage of the internet’s traffic about 3 years ago
I’m a little curious about your situation though—with regards to the CGNAT, does everyone on your ISP effectively share one (or a small pool of) IPv4 address(es)? Do you ever see issues with IP restrictions? (e.g. buying tickets for events, etc)
Luckily I haven’t noticed any restrictions.
My provider uses the same IPv4 for four different customers, and it lets each one of them use a different range of 12000 ports each (of course, the random user on ports 1-12000 is the “luckiest” one because he could theoretically host a website on port 80 or 443).
But this means I can expose my Torrent client or Plex or any other services on a custom port, directly forwarded.
It works really well in my experience. The provider is Free (France).
CGNAT is certainly becoming a real issue. In the UK at least legacy providers have millions of IP addresses in the bank and new disruptive providers do not have access to these except at extremely inflated rates.
When I changed one of these new disruptive providers I was unaware that CGNat would be imposed and all of my security cameras were no longer accessible. Fortunately they did move me off CGNat when I asked but they said it may not be forever.
Like always I don’t think this will be dealt with in any speedy capacity, unless we get lucky and some correctly positioned legislator can’t do what they want to do with their internet connection. Then it might get expedited.
Let’s hope that the EU steps in. It’s the only institution in which I have some faith left in…
But why was this attacking novels? Are comic books safe?
To execute this you need a DHCP server on the network… But any admin worth his salt has a config on the switch to limit DHCP traffic to a designated server.
Seems extremely difficult to pull off in any corporate environment
Step one, be in full control of DNS on the network. Not difficult, but not simple.
If i get this right, that attack only works before the tunnel is initiated (i.e. traffic encrypted), if the hosts is compromised, right? No danger from untrusted points inbetween, right?
No, it works at any point and the local network needs to be compromised (untrusted), the host can be secure.
So it is likely not an issue at your home unless you have weak Wi-Fi password. But on any public/untrusted Wi-Fi, it is an issue.
Yikes
That being said, it apparently does not affect Mullvad apps on any platform other than iOS (Apple does not allow fixing it on iOS). I suspect other serious VPNs are also not vulnerable outside iOS, since it is prevented by simple leak prevention mechanism.
deleted by creator
So if they are changing routes by using DHCP options, perhaps this could be exploited by telecom insiders when you are using mobile data, because your mobile data IP could be assigned by a DHCP server on the telecom network. If you’re at home on wifi, then you can control your own DHCP server to prevent that.
I use option 121 as part of my work, though I am not an expert on DHCP. This attack does make sense to me and it would be hard to work around given the legitimate uses for that option.
deleted by creator
When I design something, critical applications get their own network namespace with only the VPN interface inside anyway. So, yeah.
How do you set this up?
There’s readily available docker containers for it but I wanted to build it by hand. Well, more or less, Extremely hacky but it works, so fine for me.
I started out with cheating and used this wrapper around wg-quick that gives us a persistent network namespace with the tunnel interface in it:
https://github.com/dadevel/wg-netns
cat /etc/systemd/system/wg-qbittorrent.service [Unit] Description=WireGuard Network Namespace for qBittorrent Wants=network-online.target nss-lookup.target After=network-online.target nss-lookup.target [Service] Type=oneshot Environment=WG_ENDPOINT_RESOLUTION_RETRIES=infinity Environment=WG_VERBOSE=1 ExecStart=/opt/wg-netns/bin/wg-netns up /etc/wireguard/wgconfig.yaml ExecStop=/opt/wg-netns/bin/wg-netns down /etc/wireguard/wgconfig.yaml RemainAfterExit=yes WorkingDirectory=%E/wireguard ConfigurationDirectory=wireguard ConfigurationDirectoryMode=0700 CapabilityBoundingSet=CAP_NET_ADMIN CAP_SYS_ADMIN LimitNOFILE=4096 LimitNPROC=512 LockPersonality=true MemoryDenyWriteExecute=true NoNewPrivileges=true ProtectClock=true ProtectHostname=true RemoveIPC=true RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK RestrictNamespaces=mnt net RestrictRealtime=true RestrictSUIDSGID=true SystemCallArchitectures=native [Install] WantedBy=multi-user.targetThen I built a static binary of qbittorrent using this really neat docker image: https://github.com/userdocs/qbittorrent-nox-static
…and stuffed the result into a systemd service that runs it in the namespace wg-netns provides:
cat /etc/systemd/system/qbittorrent-nox.service [Unit] Description=qBittorrent-nox service Wants=network-online.target wg-qbittorrent.service After=local-fs.target network-online.target nss-lookup.target wg-qbittorrent.service [Service] Type=simple PrivateTmp=false #User=qbittorrent ExecStart=/usr/sbin/ip netns exec ns-qbittorrent sudo -u qbittorrent /opt/qbittorrent/qbittorrent-nox TimeoutStopSec=1800 RestartSec=15 RestartMaxDelaySec=600 RestartSteps=10 Restart=always [Install] WantedBy=multi-user.targetTo get the webui out of that I stuck two instances of socat together at the stdout and from there it depends on whatever you want to use as a reverse proxy on the host - or you bind to a network interface if you trust the network:
cat /etc/systemd/system/qbittorrent-webui.service [Unit] Description=qBittorrent-nox webui forwarding into its namespace Wants=network-online.target wg-qbittorrent.service After=local-fs.target network-online.target nss-lookup.target wg-qbittorrent.service [Service] Type=simple PrivateTmp=false ExecStart=/opt/qbittorrent/forward-webinterface.sh TimeoutStopSec=1800 Restart=always RestartSec=10 [Install] WantedBy=multi-user.targetcat /opt/qbittorrent/forward-webinterface.sh #!/bin/sh set -eu exec socat tcp6-listen:"8080",reuseaddr,fork,range=[::1]/128 "exec:ip netns exec ns-qbittorrent socat stdio 'tcp-connect:127.0.0.1:8080',nofork"Works, is reboot safe, stopped caring about beauty at that point.
This is so cool, thank you!
So…
reject 121;In your dhclient?
Does this mean I still can’t watch porn in Texas?
