3 ms·
I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blo
by agwa 2y ago
I mentioned attacks using DHCP option 121 (aka "classless static routes") nearly 9 years ago in my blog post about attacks on OpenVPN: https://www.agwa.name/blog/post/hardening_openvpn_for_def_con https://www.agwa.name/blog/post/hardening_openvpn_for_def_co... (under "Attacks on redirect-gateway")
It's really hard to make a robust VPN.
- mycall 2y agoHow hard is it for a firewall to block option 121 (and 33)? Cloudflare WARP made a robust VPN but is not cheap.
- agwa 2y agoIgnoring or blocking these options is trivial but ineffective since the DHCP server can still send a malicious subnet mask. (Edited to replace "default gateway" with "subnet mask")
- peddling-brink 2y agoForgive my ignorance, but what could a malicious gateway do in this instance?
- agwa 2y agoWhoops, I posted too early in the morning, I meant to say "malicious subnet mask" :-) Basically, the DHCP server sends a subnet mask for an absolutely huge subnet (e.g. a /2), and the route for that subnet takes precedence over the VPN route. The attacker can only intercept 25% of the IPv4 address space with a /2 but that's still pretty bad.
- peddling-brink 2y agoClever, thanks!
- gruez 2y agoIt's probably more straightforward to have the firewall block all traffic from using the non-VPN interfaces (ie. blacklist approach) instead. In the other thread[1] there was disagreement about whether commercial VPN services actually implement their 'killswitch" in this way. Apparently NordVPN does not (hearsay), but neither side provided a good survey of other providers. [1] https://news.ycombinator.com/item?id=40279632 https://news.ycombinator.com/item?id=40279632
- felixg3 2y agoCloudflare Warp is free, I think - if you create a Zero Trust Organisation for free and configure the Warp client to use it, you can use unmetered Warp+ with Argo routing without charge.
- JeremyNT 2y agoYour writeup is IMO much better than the way this is being reported. FWIW, I remember reading something similar years ago (I'm not certain it was your specific post, but it might have been). It's strange to see this being described as "novel" now, unless there's something new to it that I am missing.