So..
reject 121;
In your dhclient?
this post was submitted on 06 May 2024
499 points (100.0% liked)
Technology
70365 readers
6048 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
This is the best summary I could come up with:
Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering.
TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address.
The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network.
A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel.
When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks.
This remedy is problematic for two reasons: (1) a VPN user connecting to an untrusted network has no ability to control the firewall and (2) it opens the same side channel present with the Linux mitigation.
The original article contains 903 words, the summary contains 196 words. Saved 78%. I'm a bot and I'm open source!
Does this mean I still can't watch porn in Texas?
Aren't you aware of the loophole that you can as long as your cousin is in it and you hold a rosary while you watch it?
load more comments
(1 replies)
When I design something, critical applications get their own network namespace with only the VPN interface inside anyway. So, yeah.
load more comments
(8 replies)
If someone uses vpns for anything other than region locked content then that’s not very smart.
It’s one big security risk and no attacks are necessary for some vpn company tech to sell your data. Hell I’d do it myself to a highest bidder, sorry.
It’s like walking naked around some stranger’s house and trusting them to close their eyes.
load more comments
(6 replies)
Meh, option 121 shenanigans can be detected and remediated via post connection scripting.