Technology

37343 readers

502 users here now

Rumors, happenings, and innovations in the technology sphere. If it's technological news or discussion of technology, it probably belongs here.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

Researchers claim to have detected vulnerabilities in VPN clients that went unnoticed -at least publicly- since 1996 (tunnelcrack.mathyvanhoef.com)

submitted 10 months ago by [email protected] to c/[email protected]

10 comments fedilink hide all child comments

Tests indicate that every VPN product is vulnerable on at least one device, the researchers say. VPNs for iPhones, iPads, MacBooks, and macOS are extremely likely to be vulnerable, that a majority of VPNs on Windows and Linux are vulnerable, and that Android is the most secure with roughly one-quarter of VPN apps being vulnerable.

top 10 comments

sorted by: hot top controversial new old

[–] [email protected] 91 points 10 months ago (2 children)

"Both attacks manipulate the victim's routing table to trick the victim into sending traffic outside the protected VPN tunnel, allowing an adversary to read and intercept transmitted traffic. "

I hate clickbait titles. A better title for this would be, local routing attack may expose some VPN traffic. It's pretty esoteric, not seen in the wild, and requires your adversary to have control of your local network and exposes traffic of a very particular kind. These panic inducing headlines are just annoying and they desensitize us

[–] [email protected] 8 points 10 months ago

Well, depending what your local network is, this could be a problem. I imagine cellphone networks i.e. could be affected.

[–] [email protected] 5 points 10 months ago

have control of your local network

traffic of a particular kind

Could you give an example of what this looks like? I'm sure I'll have friends sending me similar articles / YouTube videos. Would be nice to have a simple and accurate analogy

[–] [email protected] 24 points 10 months ago (1 children)

I wish they’d been more specific in the general description; this is a local routing attack that can be applied against clients of public VPN services.

For a moment I was worried about my personal VPN, which is not configured in a way that this abuse could happen.

[–] [email protected] 7 points 10 months ago* (last edited 10 months ago) (1 children)

Traffic leaking has always been a concern when sitting up a VPN or any network infrastructure. Especially when you're dealing with sensitive data. These concerns are old, and not sensational, new traffic leak discovered in local routing configuration of some VPN clients.

The truly paranoid would have a always-on VPN, no traffic may go outside the VPN, defense in depth. A VM that can only talk to the VPN endpoint. You could use qubes to configure something bulletproof, mullvad even has an article explaining how to do this yourself.

Just out of good hygiene I have leak checks in my computing systems. If they succeed it shuts everything down. Like if you open a browser it checks your external facing IP address. Imagine it's pretty common for people.

[–] [email protected] 3 points 10 months ago (1 children)

Very few people have functional leak checking set up; personally, I think it should be a built-in OS level function.

[–] [email protected] 2 points 10 months ago

It would be nice. But it's a hard problem to solve. To figure out somebody's intense by running a VPN or having certain IP routing rules.

https://mullvad.net/en/help/qubes-os-4-and-mullvad-vpn/

I do like in this guy day emphasize setting up routing rules so the VPN can only route traffic to VPN endpoints. It's a nice fail safe

[–] [email protected] 11 points 10 months ago (1 children)

It's too bad they don't offer a complete list of known patched VPNs. They just give like 5 example ones. It'd be really helpful to know if my service has patched already or not.

[–] [email protected] 6 points 10 months ago

unsure about patches applied since writing, but near the ending pages in the original paper theres a more exhaustive list of the state of vpns

[–] [email protected] 3 points 10 months ago

https://mullvad.net/en/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/ is Mullvad's response to this topic. TLDR not a concern other than possibly for IOS.