Researchers from Leviathan Security have discovered a new vulnerability that affects virtual private networks (VPNs) on most platforms.

VPNs serve multiple purposes. They encrypt all traffic when connected to a VPN server to prevent eavesdropping and tampering. VPNs furthermore help users stay anonymous, as the VPNs IP address is revealed to websites and services.

TunnelVision is a new attack that manipulates traffic using rogue DHCP servers. All of this happens without dropping of the VPN connection or kill-switch functionality taking note and blocking all Internet connectivity. For the user, the VPN connection appears to work without issues.

TunnelVision Fact Sheet

• Works on all major platforms except for Android.
• A potential fix could be developed for Linux.
• Requires a rogue DHCP server.
• Vulnerability could date back to 2002.

TunnelVision in action

The attack requires access to a DHCP server that the target's device communicates with. The core purpose of DHCP servers is to provide and assign IP addresses to client devices.

DHCP servers support a preference called option code 121, which the attack uses to route the traffic of the target's device through the DHCP server.

The researches explain: "Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway. When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it."

For the attack to work, it is necessary that the target accepts "a DHCP lease" from the rogue DHCP server and that option 121 is implemented. The researches note that attackers who are on the same network as the target may "become their DHCP server" using a number of attack techniques.

Having administrative control over the network is another possibility to attack users who use VPNs to protect their data.

Some or all of a target's traffic may be routed through the unencrypted channel. The VPN program or app continues to report that all data is protected, even while that is not the case.

A proof of concept video was published on YouTube:

Potential fixes for the issue

The technical blog post lists several potential fixes or mitigations. Not all are without problems, however:

• Network Namespaces -- The feature could fix the vulnerability on Linux, but it "less commonly implemented".
• Firewall rules -- Denying all inbound and outbound traffic to and from the physical interface using firewall rules. This introduces " selective denial of service for traffic using the DHCP route" and "a side-channel".
• Ignore Option 121 -- A potential mitigation is to ignore option 121 while VPN connections are active. Android does not support the option at all, which is why it is unaffected by the vulnerability. This must be implemented on the OS level.
• Use of a hotspot or virtual machine -- Hotspots or virtual machines mitigate the vulnerability, as the attacker does not have access to this temporary network.

What about you? Do you use VPNs frequently or regularly?