Decloaking VPN traffic: New critical vulnerability
This allows the ISP or local router to see the VPN traffic by abusing your router
Tinfoil Hat
Remember all the people calling me a tinfoil hat wacko for insisting on open source routers?
TunnelVision
There is a new critical VPN vulnerability from Leviathan Security group, which they call “TunnelVision”. It allows the ISP or local router to see the VPN traffic by abusing the DHCP client and option 121
Here’s the basics:
LAN
–It uses the local area network, so we’re talking about a hostile router
Android safe
—Android is safe by default and unaffected.
Linux depends
—Linux may be safe if used correctly.
Windows & Apple
–Microsoft Windows and Apple are highly vulnerable.
In Wild
–While Leviathan created it, they think it’s been used in the wild since maybe even 2002
DHCP
–Abuses the DHCP server to incorrectly route packets
–Random devices can pretend to be the router with DHCP attacks
How it works:
DHCP Basics
DHCP is when a home router assigns IP addresses to devices in your local area network. There is “ option 121” which allows that router (DHCP server) to route the VPN user’s system in a way that is more specific than those used by most VPNs. TunnelVision abuses option 121 to purposefully route the system through their fake interface.
Why Android is immune:
Android ignores option 121
How Linux users can protect themselves
Quote from Leviathan:
“Using network namespaces on Linux can completely fix this behavior. However, in our experience, it is less commonly implemented. WireGuard’s documentation shows how it’s possible to use a namespace for all applications with traffic that should be using a VPN before sending it to another namespace that contains a physical interface. However, this appears to be Linux-specific functionality and it’s not clear if there is a solution for Windows, MacOS, or other operating systems with the same amount of robustness.”
Source:
https://www.leviathansecurity.com/blog/tunnelvision
And of course, Linux PLUS an open source router is the real protection. Check out the router section of our site, https://simplifiedprivacy.com/category/routers/index.html
If you really want to learn and take your privacy to the next level, subscribe to our new content via: Podcast RSS, Session list, Nostr, Bastyon, Article RSS, or join the Signal Group
Related Posts
Doxxed Through VPNs: Former Cybercrime Detective
Our Interview with Travis West on identifying VPN users
[SP]
Jan 28, 2025
New Release: v1.2.2 w/ Rotating WireGuard Keys!
New Settings Tab with v1.2.2!
[SP]
Jan 24, 2025
Why this Browser VPN Combo Exists?
What you Need to Know about Browser Fingerprinting.
[SP]
Jan 23, 2025
Supported Distros
What distros our VPN supports.
[SP]
Jan 20, 2025