Sounds like it requires that your DHCP server is hostile, which is actually a very small (though nonzero, yes) number of the attack scenarios that VPNs are designed for
“there are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android” is a very funny way of saying “in practice applies only to Windows and iOS”.
Sounds like it requires that your DHCP server is hostile, which is actually a very small (though nonzero, yes) number of the attack scenarios that VPNs are designed for
In most situations, any host on the LAN can become a DHCP server.
“there are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android” is a very funny way of saying “in practice applies only to Windows and iOS”.
No. There are certainly ways of mitigating it, but afaict no Linux distros have done so yet.
When I use a VPN, I very rarely imagine that the coffee shop / home internet that I’m hooked up to will have a malicious actor or compromised host physically inside it. I mean, maybe. But more likely is that I’m protecting against a malicious ISP, or effectively doing an extra level of authentication to my work network before I get access to non-world-visible elements of it (that shouldn’t be exposed to anyone in the world that wants to poke at it). The “someone else at the cafe is malicious” case isn’t un-heard of, but it’s not the most common threat model. That’s my point.
From the article:
When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks.
“Deanonymize” and denial of service are very very different from hijacking the connection and rerouting destination traffic to a hostile device, which it sounds like are what’s possible on iOS and Windows.
I don’t really know the full details (e.g. what does it mean that “there’s a setting”, and is activating that setting starting this week any different in practice from applying the patch that will surely come this week for Windows and iOS). But it does sound fair to say that there’s a serious level of vulnerability that’s exclusive to Windows and iOS.
In most situations, any host on the LAN can become a DHCP server.
No. There are certainly ways of mitigating it, but afaict no Linux distros have done so yet.
When I use a VPN, I very rarely imagine that the coffee shop / home internet that I’m hooked up to will have a malicious actor or compromised host physically inside it. I mean, maybe. But more likely is that I’m protecting against a malicious ISP, or effectively doing an extra level of authentication to my work network before I get access to non-world-visible elements of it (that shouldn’t be exposed to anyone in the world that wants to poke at it). The “someone else at the cafe is malicious” case isn’t un-heard of, but it’s not the most common threat model. That’s my point.
From the article:
“Deanonymize” and denial of service are very very different from hijacking the connection and rerouting destination traffic to a hostile device, which it sounds like are what’s possible on iOS and Windows.
I don’t really know the full details (e.g. what does it mean that “there’s a setting”, and is activating that setting starting this week any different in practice from applying the patch that will surely come this week for Windows and iOS). But it does sound fair to say that there’s a serious level of vulnerability that’s exclusive to Windows and iOS.