5 ms·

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher prio

I don't know why this article is so long. DHCP Option 121 allows the DHCP server to set routing rules for a given CIDR range, which end up having a higher priority than the default 0.0.0.0/0 rule due to higher specificity (longer prefix).

morattisec 2y ago
One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you should skip to the POC section”. I’ll make sure that gets updated/more obvious.
- nonrandomstring 2y ago
  Good call. For a general IT audience you are speaking to, context building really helps refresh the scene before dropping the exploit. Well communicated.
- bimguy 2y ago
  Great write up by the way. Even some technical people might not know about this, not all technical people are network experts after all.
- tgsovlerkhgsel 2y ago
  The PoC section doesn't explain the issue. I think a one-line TL;DR similar to the summary above would be best, e.g. "A malicious DHCP server can use DHCP Option 121 to set routing rules, which can override the routing rule used by VPNs and cause traffic to be routed outside the VPN" (I like it that you provide the background for people who need it, but also found the actually relevant information extremely annoying to find.)
  - wolverine876 2y ago
    > found the actually relevant information extremely annoying to find Skip down to the DHCP section?
  - dylan604 2y ago
    Just accept you were not the target audience and skim like the rest of the world. Not every article is written for you. It's available for you to read, but was more than likely not with you in mind. Some of us still like words and the reading of them when they provide details and more in-depth understanding than a tweet.
    - mindslight 2y ago
      I hate tweet culture as much as anybody, but this is not the alternative. This article is so painfully long, I got bored even just trying to skim it. Reading it word for word will turn any noob into a seasoned greybeard through the sheer passage of time. If you really like words and reading them this much, I'd recommend adding some dictionaries to your reading list.
      - tgsovlerkhgsel 2y ago
        ChatGPT is great for providing endless reading material too!
  - timbre1234 2y ago
    Or they could have maybe lead with that sentence and THEN given the explanation. Too many tech people have that "I want to slowly lead you to the point like Sherlock Holmes mystery" style of writing, and it is such a time-waste. Arthur Conan Doyle was paid by the word, you aren't. Please, everyone, back to middle school: State a Thesis in your first sentence and THEN expand on it, don't force me to spend pages trying to figure it out.
    - aeonik 2y ago
      It's not just tech people, but any field with a high enough complexity. The "abstract" of a journal article is supposed to contain all the key points of a science experiment including the results, but it's too rare that they do. I think some folks are just hitting their limits, and needed more time to digest/ review their publication. Other folks are doing it I obfuscate or pad their work, for whatever reason.
- wolverine876 2y ago
  What I read does a great job of explaining the technology; I know it pretty well but it's great to have an updated, clear, concise, well-organized, integrated explanation all in one place. I can't imagine how long that took to make it that clear! (Everything posted here gets similar complaints about the writing, headline, too short, too long, too hot, too cold, etc. Goldilocks is never pleased here. Welcome to HN! :)
- idkdotcom 2y ago
  Have you identified actual VPN vendors that are affected by this? I won't disclose which ones I use, but I would love to know if they have been affected.
- banister 2y ago
  I looked at this in detail. This exploit is a nothing-burger for most decent VPNs. A simple "leak protection" (aka Killswitch) firewall rule completely negates this attack. All decent VPNs implement such a rule by default. Dealing with undesirable routes (whether pre existing or pushed by a DHCP server) is nothing new or in the slightest bit hard to defend against. If a VPN does not implement such a firewall rule already then it's likely already leaking so all this exploit demonstrates is that "A VPN without leak protection, leaks". (I won't even mention the "side channel" attack as it's completely ridiculous) I liked your write-up and option 121 is a little known option, so it's good to know about. But let's not pretend this thing is bigger than it is.
  - barbariangrunge 2y ago
    Looking at mozilla vpn, I can’t tell if there is such a setting, unless it’s just enabled by default. Can anyone clarify?
    - SushiHippie 2y ago
      > A VPN kill switch is a must-have for privacy reasons when using a VPN. If you are actively using the VPN to transfer data and your Internet connection becomes unstable or drops, the entire network connection on your device will be blocked to prevent your local IP address from being exposed to the outside world. The kill switch is on by default on Windows, Android, iOS, macOS and Linux and there is no setting to turn it off. https://support.mozilla.org/en-US/kb/mozilla-vpn-kill-switch https://support.mozilla.org/en-US/kb/mozilla-vpn-kill-switch
  - CommitSyn 2y ago
    FTA: Importantly, the VPN control channel is maintained so features such as kill switches are never tripped, and users continue to show as connected to a VPN in all the cases we’ve observed.
    - banister 2y ago
      They don't know what they're talking about. Kill switches are not "tripped" there is no "control channel". A kill switch is just a firewall rule that is ALWAYS engaged and all it does is blocks off-VPN traffic. It 100% will defend against this exploit.
ajsnigrutin 2y ago
...and the attacker needs to be in the same L2 network as the victim to trigger the attack. (i guess... didn't read the article, just the post above)
- sambazi 2y ago
  virtual network interfaces are a thing
  - ajsnigrutin 2y ago
    Sure, but he still needs access to the L2 network, the virtual interface has to be connected/bridged to something. Unless if you're thinking about a virtual interface and dhcp server directly on the victims pc (bridged to the interface with the dhcp client), but if the attacker can do that, he can also just capture the data directly.
  - remram 2y ago
    Yes but what do you mean by that?

morattisec 2y ago

One of the authors here, the intention was to provide a primer of the topics since we figured this would draw people from a nontechnical background too. That and half the information on the internet about VPNs is from VPN providers and is incorrect or not technical enough to describe how they _actually_ work. We had a sentence in the intro that was supposed to be a hyperlink to the “hey if you know this stuff you should skip to the POC section”. I’ll make sure that gets updated/more obvious.

nonrandomstring 2y ago
Good call. For a general IT audience you are speaking to, context building really helps refresh the scene before dropping the exploit. Well communicated.
bimguy 2y ago
Great write up by the way. Even some technical people might not know about this, not all technical people are network experts after all.
tgsovlerkhgsel 2y ago
The PoC section doesn't explain the issue. I think a one-line TL;DR similar to the summary above would be best, e.g. "A malicious DHCP server can use DHCP Option 121 to set routing rules, which can override the routing rule used by VPNs and cause traffic to be routed outside the VPN" (I like it that you provide the background for people who need it, but also found the actually relevant information extremely annoying to find.)
- wolverine876 2y ago
  > found the actually relevant information extremely annoying to find Skip down to the DHCP section?
- dylan604 2y ago
  Just accept you were not the target audience and skim like the rest of the world. Not every article is written for you. It's available for you to read, but was more than likely not with you in mind. Some of us still like words and the reading of them when they provide details and more in-depth understanding than a tweet.
  - mindslight 2y ago
    I hate tweet culture as much as anybody, but this is not the alternative. This article is so painfully long, I got bored even just trying to skim it. Reading it word for word will turn any noob into a seasoned greybeard through the sheer passage of time. If you really like words and reading them this much, I'd recommend adding some dictionaries to your reading list.
    - tgsovlerkhgsel 2y ago
      ChatGPT is great for providing endless reading material too!
- timbre1234 2y ago
  Or they could have maybe lead with that sentence and THEN given the explanation. Too many tech people have that "I want to slowly lead you to the point like Sherlock Holmes mystery" style of writing, and it is such a time-waste. Arthur Conan Doyle was paid by the word, you aren't. Please, everyone, back to middle school: State a Thesis in your first sentence and THEN expand on it, don't force me to spend pages trying to figure it out.
  - aeonik 2y ago
    It's not just tech people, but any field with a high enough complexity. The "abstract" of a journal article is supposed to contain all the key points of a science experiment including the results, but it's too rare that they do. I think some folks are just hitting their limits, and needed more time to digest/ review their publication. Other folks are doing it I obfuscate or pad their work, for whatever reason.
wolverine876 2y ago
What I read does a great job of explaining the technology; I know it pretty well but it's great to have an updated, clear, concise, well-organized, integrated explanation all in one place. I can't imagine how long that took to make it that clear! (Everything posted here gets similar complaints about the writing, headline, too short, too long, too hot, too cold, etc. Goldilocks is never pleased here. Welcome to HN! :)
idkdotcom 2y ago
Have you identified actual VPN vendors that are affected by this? I won't disclose which ones I use, but I would love to know if they have been affected.
banister 2y ago
I looked at this in detail. This exploit is a nothing-burger for most decent VPNs. A simple "leak protection" (aka Killswitch) firewall rule completely negates this attack. All decent VPNs implement such a rule by default. Dealing with undesirable routes (whether pre existing or pushed by a DHCP server) is nothing new or in the slightest bit hard to defend against. If a VPN does not implement such a firewall rule already then it's likely already leaking so all this exploit demonstrates is that "A VPN without leak protection, leaks". (I won't even mention the "side channel" attack as it's completely ridiculous) I liked your write-up and option 121 is a little known option, so it's good to know about. But let's not pretend this thing is bigger than it is.
- barbariangrunge 2y ago
  Looking at mozilla vpn, I can’t tell if there is such a setting, unless it’s just enabled by default. Can anyone clarify?
  - SushiHippie 2y ago
    > A VPN kill switch is a must-have for privacy reasons when using a VPN. If you are actively using the VPN to transfer data and your Internet connection becomes unstable or drops, the entire network connection on your device will be blocked to prevent your local IP address from being exposed to the outside world. The kill switch is on by default on Windows, Android, iOS, macOS and Linux and there is no setting to turn it off. https://support.mozilla.org/en-US/kb/mozilla-vpn-kill-switch https://support.mozilla.org/en-US/kb/mozilla-vpn-kill-switch
- CommitSyn 2y ago
  FTA: Importantly, the VPN control channel is maintained so features such as kill switches are never tripped, and users continue to show as connected to a VPN in all the cases we’ve observed.
  - banister 2y ago
    They don't know what they're talking about. Kill switches are not "tripped" there is no "control channel". A kill switch is just a firewall rule that is ALWAYS engaged and all it does is blocks off-VPN traffic. It 100% will defend against this exploit.

ajsnigrutin 2y ago

...and the attacker needs to be in the same L2 network as the victim to trigger the attack. (i guess... didn't read the article, just the post above)

sambazi 2y ago
virtual network interfaces are a thing
- ajsnigrutin 2y ago
  Sure, but he still needs access to the L2 network, the virtual interface has to be connected/bridged to something. Unless if you're thinking about a virtual interface and dhcp server directly on the victims pc (bridged to the interface with the dhcp client), but if the attacker can do that, he can also just capture the data directly.
- remram 2y ago
  Yes but what do you mean by that?