3 ms·
I swore I had already read about this attack from some other author, so I went searching and after sifting through tons of VPN provider spam in search results I
by k0ss_net 2y ago
I swore I had already read about this attack from some other author, so I went searching and after sifting through tons of VPN provider spam in search results I found the prior work [1].
This new article goes into some more depth on how to exploit the flaw and has some code to help PoC it though.
1: https://www.usenix.org/conference/usenixsecurity23/presentation/xue https://www.usenix.org/conference/usenixsecurity23/presentat...
- gnabgib 2y agoThat article is referenced in the Appendix: However, neither technique described in the August 2023 paper leveraged DHCP option 121 to push routes. Pushing routes through DHCP has a significantly higher impact from the same attacker vantage point (the ability to hand out IP leases for a non-RFC1918 range or spoofing DNS replies).
- k0ss_net 2y agoAh good find, I totally missed the appendix when reading on mobile.
- sambazi 2y agothe "attack" is widely known and is used as a config option for the openvpn client (redirect-gateway def1)