Cyber security experts recently discovered a new type of cyber vulnerability called TunnelVision, which affects most VPN services hosted on non-Linux and non-Android operating systems.
This vulnerability allows attackers to redirect a VPN user’s traffic outside the encrypted tunnel, thereby exposing sensitive information, including their geographic location and potentially their identity.
TunnelVision allows the interception of a victim’s Internet traffic, which gives the attacker the ability to read, modify or delete the transmitted information. Even if the victim remains connected to the VPN and the Internet, the attacker can access the traffic by manipulating the DHCP server, which assigns IP addresses to devices on a local network.
Specifically, the attacker uses an option in the DHCP server, known as option 121, to override the VPN’s standard routing rules, thus directing traffic directly to it.
What vulnerability is it about?
To launch such an attack, the attacker needs to have administrative control over the network the victim is trying to connect to. By configuring the DHCP server to use option 121, the attacker can cause the server to send traffic through unencrypted IP addresses, making it possible to intercept data. The attack can also be carried out by low-privileged users by configuring their own fake DHCP server, the source said.
It should be noted that Android operating systems are immune to this type of attack because they do not implement option 121, unlike other operating systems. To date, no concrete solutions have been proposed to counter this vulnerability on affected systems, leaving a significant number of users at risk of data interception.
Add comment
Tags: vulnerabilities VPN services List operating systems offer protection
-
