So there's a new attack in town called tunnel vision or bug
I don't know if it's a bug or a feature, because it was a little confusing when I first looked at it going, this is working as expected
Oh, I guess that's not the greatest way to use this as expected. So she uses a DHCP option that allows you to add routes
Now, that sounds pretty simple. It's been around for a long time
That's why they have the headlines that they do here in May of 2024 about longtime bug, but more no one's really using it this way
or maybe they are. We don't know. But it's more of an attack on full tunnel versus split tunnel VPNs
And that's why I do is kind of simplify it. I'll leave links to the research because there's a lot to read
There's a lot in this paper. I think they did a great job doing the research
And I'm not going to bother linking to the news articles because, hey, why not go right to the source? But I do want to do a pretty simple explainer so you can understand
how this may or may not affect you, because you may not really care whether or not your traffic gets decloaked
So let's get started. Now, I'm going to start with a split tunnel VPN setup
This is pretty common where you're on a remote network, you're at some untrusted place
and you want to get back to your office or home network. We have our remote network at 172.16.16.0.24
That is the resources that are on this network and what your computer needs to know to get out to the firewall
So that routing information is here. And this allows us to establish a connection over the Internet
to our firewall at our office network, which has a VPN service set up on there
Now, the IBC are going to know this remote network that you're connecting to this VPN and with a proper set up VPN
with a proper key exchange, all that transaction other than the IP address is going to be fully encrypted
And then from that, we will create this encrypted data channel. We have the outer layer, which is the communication channel
and we have the encrypted layer, the data channel. And we're going to get to the resources at 192.168.55.0.24
What this means is anytime you want to access something, one of these servers over here that are all in this IP range
it will automatically send that out over the encrypted tunnel and any other traffic surfing the web, et cetera
just goes out through the normal Internet. Pretty common VPN setup. Now, full VPN setup, full tunnel VPN setup means
not just the resources for this office network, but send everything across the Internet
Now, we still technically aren't sending everything because we have to have this outer control channel to talk
and make sure our encrypted data channel is working. So the system still needs to know the local network
knows how to get to the firewall. This firewall is going to be aware that all this traffic's heading over here
It's not going to be able to see it because of the proper setup VPN and a good key exchange
So all the data is encrypted. And when you have zero zero zero zero zero zero
that means send all the data over and there's going to be an exception
Systems are smart enough to handle this to say, hey, except for the 172
network stuff, yeah, that's got to go over to this firewall. So pretty simple setup
And that means your IP address looks like it comes from your office
or home network. That's why I kind of show the Internet coming out here. And when you go to resources on the Internet, they go here
When you go to resources that are local, they are out here. Pretty simple and once again, common setup
Where we have tunnel vision fitting in is tunnel vision is adding extra routes via DHCP one twenty one
And we then take in override essentially these routes. So we're not just adding the 172 route, but let's go ahead and add a couple more
I chose one dot one dot one dot one and eight dot eight dot eight dot eight
because let's talk about a couple of DNS servers. What if they were to take those and add them to your DHCP routes
Well, now those go out over the Internet represented here with these red dots that are moving
So now your system has these extra routes that have been added by DHCP
and they're not going out over the encrypted data channel. So anything that has added extra routes
doesn't route back over your encrypted data channel. Now, this matters, obviously, a lot if you're using a privacy VPN
because you wanted privacy from the remote network that you were on, being able to see what websites you're going to
Now, the websites we use today in twenty twenty four, the majority of all of them are encrypted
All your major websites are in many of your minor and just general web surfing sites all use encryption
So the things they are able to see are perhaps DNS queries or they can see some of the SNI information because that's not always encrypted
So that would be, you know, hey, I know you're going to Amazon dot com, Google dot com, Facebook dot com, et cetera
And they would be able to do that by taking the blocks of IPs that are assigned to those websites and putting them in those routes
that split them out of your tunnel. Now let's talk about mitigations available here in May of twenty twenty four
And I say mitigation because this is a feature, not a bug. It's just a buggy way to use this feature
And if you have an Android phone, you're immune. So awesome. That makes it simple for Android users because they chose
when they wrote Android not to use option one twenty one. But if you're running Mac, Windows or Linux, how do you solve this
The researchers suggested using a virtual machine that supports an adding, so a non bridge network adapter
That is an option, for example, that VirtualBox has. That's one way to do it, where you run the VPN on the virtual machine
That seems kind of tedious. Another way I kind of thought about that would make a lot of sense
would be travel routers. And I figure this is a good audience for that, for people that may have
these already going. You could take the travel router. You could connect it to this nefarious network, handing out the extra options
The travel router could accept those options, but it's not going to pass them on unless for some reason you told it to
And it would take extra steps. It's not going to pass those on to the devices behind it
They have their own route that they get to the travel router and the travel router gets those other routes
But it doesn't really matter because those routes won't override the VPN
because the VPN is not running on your travel router. If you're doing it right, you'd run the VPN on the devices
behind the travel router. The third option that they suggest that the researchers
were using your phone as a hotspot. That's another option. And basically that's saying don't connect to shady networks
that you don't trust. Obviously, it's not a big deal for home users, unless someone else has control over your router as a home user
Then you have completely different problems. They're beyond the scope of this video
Nonetheless, I love hearing from you. Leave your thoughts and comments down below. Head over to my forums, forums.lawrencesystems.com
to have a more in-depth discussion about this and other topics. Like and subscribe to see more content from the channel
Head over to lawrencesystems.com. Check out our swag store and sign up for our newsletter
if you want to keep up with some of the goings on. Thanks. Lawrence. System. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence. Lawrence