Technology

59593 readers

3792 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

497

Novel attack against virtually all VPN apps neuters their entire purpose (arstechnica.com)

submitted 6 months ago by jeffw@lemmy.world to c/technology@lemmy.world

134 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] rimu@piefed.social 12 points 6 months ago (4 children)

No - the VPN provider has another DHCP server for use 'inside' the VPN.

[–] SzethFriendOfNimi@lemmy.world 15 points 6 months ago

Except this bypasses that I believe.

[–] ignirtoq@fedia.io 5 points 6 months ago

The attack vector described in the article uses the VPN client machine's host network, i.e. the local network the device is attached to. They don't discuss the DHCP server of the VPN provider.

[–] mox@lemmy.sdf.org 4 points 6 months ago* (last edited 6 months ago)

Read this part more carefully:

By pushing routes that are more specific than a /0 CIDR range that most VPNs use, we can make routing rules that have a higher priority than the routes for the virtual interface the VPN creates.

Most traffic gets sent through a VPN only because of a default gateway (set by the VPN) in the client's routing table. If the client's ISP were to have their DHCP server set one or more specific routes that are broad enough to cover most of the global address space, they would effectively override that default gateway. I believe that's the scenario described in the article.

Note that the "ISP" here could be a mobile operator, an internet cafe, an airport, someone running a wifi access point that looks like the airport's, or a guest on the same local network running an unauthorized DHCP server.

[–] Max_P@lemmy.max-p.me 3 points 6 months ago

Most VPN providers don't use DHCP. OpenVPN emulates and hooks DHCP requests client-side to hand the OS the IP it got over the OpenVPN protocol in a more standard way (unless you use Layer 2 tunnels which VPN providers don't because it's useless for that use case). WireGuard doesn't support DHCP at all and it always comes from configuration.