Critical VPN flaw discovered: the TunnelVision attack

Researchers at Leviathan Security Group have highlighted a major vulnerability in VPNs that could undermine their security. The attack, called TunnelVision (CVE-2024-3661), exploits a feature of the DHCP protocol that has existed since 2002. This option, originally intended to facilitate network configuration, allows hackers to divert data traffic from a VPN connection out of its encrypted tunnel, thus making it possible to intercept the information transmitted.

The technical functioning of the TunnelVision attack

The attack exploits DHCP option 121, which allows the addition of static routes in network clients. Experts have shown that by creating a dummy DHCP server in the same network as the target, it is possible to redirect VPN traffic to a gateway under the attackers' control. Although the VPN system still indicates that the connection is secure, in reality some or all of the user's traffic is routed outside the encrypted tunnel.

Operating systems at risk and possible mitigations

This research shows that all operating systems, except Android, are susceptible to this attack. Android is immune because it does not support DHCP option 121. For Linux users, there is a possible mitigation, although it introduces a potential back channel that could be exploited for denial of service (DoS) attacks. This scenario poses a particular threat in public network environments, such as airports or cafes, where the use of VPN networks is frequent to protect the transmission of sensitive data.

Recommendations for protection from TunnelVision

In response to this vulnerability, Leviathan Security Group suggests some defense strategies. One approach is to use personal hotspots, which create a secure LAN with authentication. Another security measure is to use virtual machines with direct network configurations, which isolate network traffic in a more controlled manner. Both solutions are aimed at preventing unwanted access to data traffic through potentially compromised networks.