{"id":115607,"date":"2024-05-07T13:52:17","date_gmt":"2024-05-07T11:52:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp"},"modified":"2024-05-07T13:52:17","modified_gmt":"2024-05-07T11:52:19","slug":"ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","title":{"rendered":"\u00datok TunnelVision, kter\u00fd umo\u017e\u0148uje p\u0159esm\u011brov\u00e1n\u00ed VPN provozu prost\u0159ednictv\u00edm manipulace s DHCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ve\u0159ejnosti byl p\u0159edlo\u017een \u00fatok TunnelVision, kter\u00fd umo\u017e\u0148uje p\u0159i p\u0159\u00edstupu do lok\u00e1ln\u00ed s\u00edt\u011b nebo kontrole nad bezdr\u00e1tovou s\u00edt\u00ed p\u0159esm\u011brov\u00e1n\u00ed ob\u011bhu ob\u011bti na sv\u016fj hostitelobeze VPN (m\u00edsto odes\u00edl\u00e1n\u00ed p\u0159es VPN bude ob\u011bh zasl\u00e1n otev\u0159en\u011b bez tunelov\u00e1n\u00ed do syst\u00e9mu \u00fato\u010dn\u00edka). Probl\u00e9m se t\u00fdk\u00e1 v\u0161ech VPN klient\u016f, kte\u0159\u00ed nepou\u017e\u00edvaj\u00ed izolovan\u00e9 n\u00e1zvov\u00e9 prostory s\u00ed\u0165ov\u00e9ho subsyst\u00e9mu (network namespace) p\u0159i sm\u011brov\u00e1n\u00ed ob\u011bhu do tunelu, nebo nenastavuj\u00ed pravidla filtrov\u00e1n\u00ed paket\u016f, kter\u00e1 zakazuj\u00ed sm\u011brov\u00e1n\u00ed VPN ob\u011bhu p\u0159es existuj\u00edc\u00ed fyzick\u00e9 s\u00ed\u0165ov\u00e9 rozhran\u00ed. <\/p>\n

Podstata \u00fatoku spo\u010d\u00edv\u00e1 v tom, \u017ee \u00fato\u010dn\u00edk m\u016f\u017ee spustit sv\u016fj DHCP server a pou\u017e\u00edt jej k p\u0159ed\u00e1n\u00ed informac\u00ed klientovi ke zm\u011bn\u011b sm\u011brov\u00e1n\u00ed. Zejm\u00e9na m\u016f\u017ee \u00fato\u010dn\u00edk vyu\u017e\u00edt v protokolu DHCP poskytovanou mo\u017enost 121 (RFC-3442, p\u0159ijat\u00e1 v roce 2002), ur\u010denou pro p\u0159ed\u00e1v\u00e1n\u00ed informac\u00ed o statick\u00fdch tras\u00e1ch, k proveden\u00ed zm\u011bn v tabulce sm\u011brov\u00e1n\u00ed na stroji ob\u011bti a p\u0159esm\u011brov\u00e1n\u00ed ob\u011bhu. VPN<\/a>. P\u0159esm\u011brov\u00e1n\u00ed se prov\u00e1d\u00ed nastaven\u00edm s\u00e9rie tras pro pods\u00edt\u011b s prefixem \/1, kter\u00e9 maj\u00ed vy\u0161\u0161\u00ed prioritu ne\u017e pou\u017eit\u00e1 implicitn\u00ed trasa s prefixem \/0 (0.0.0.0\/0), tak\u017ee ob\u011bh bude m\u00edsto stanoven\u00e9ho pro VPN virtu\u00e1ln\u00ed s\u00ed\u0165ov\u00e9 rozhran\u00ed sm\u011brov\u00e1n p\u0159es fyzick\u00e9 s\u00ed\u0165ov\u00e9 rozhran\u00ed na hostitele \u00fato\u010dn\u00edka v lok\u00e1ln\u00ed s\u00edti. <\/p>\n

\u00datok m\u016f\u017ee b\u00fdt proveden v jak\u00fdchkoli opera\u010dn\u00edch syst\u00e9mech, kter\u00e9 podporuj\u00ed volbu 121 DHCP, v\u010detn\u011b Linuxu, Windows, iOS a macOS, bez ohledu na pou\u017eit\u00fd VPN protokol (Wireguard, OpenVPN, IPsec) a sadu \u0161ifr\u016f. Na platformu Android nen\u00ed \u00fatok zam\u011b\u0159en, proto\u017ee nezpracov\u00e1v\u00e1 volbu 121 v DHCP. Tento \u00fatok umo\u017e\u0148uje p\u0159\u00edstup k ob\u011bhu, ale neumo\u017e\u0148uje zas\u00e1hnout do spojen\u00ed a ur\u010dit obsah, kter\u00fd je p\u0159ed\u00e1v\u00e1n pomoc\u00ed zabezpe\u010den\u00fdch aplika\u010dn\u00edch protokol\u016f, jako jsou TLS a SSH; nap\u0159\u00edklad \u00fato\u010dn\u00edk nem\u016f\u017ee ur\u010dit obsah po\u017eadavk\u016f p\u0159es HTTPS, ale m\u016f\u017ee zjistit, na kter\u00e9 servery jsou odes\u00edl\u00e1ny. <\/p>\n

Pro ochranu proti \u00fatoku lze na \u00farovni paketov\u00e9ho filtru zak\u00e1zat odes\u00edl\u00e1n\u00ed paket\u016f ur\u010den\u00fdch do VPN rozhran\u00ed p\u0159es jin\u00e9 s\u00ed\u0165ov\u00e9 rozhran\u00ed; blokovat DHCP pakety s volbou 121; pou\u017e\u00edvat VPN v r\u00e1mci samostatn\u00e9ho virtu\u00e1ln\u00edho stroje (nebo kontejneru), izolovan\u00e9ho od vn\u011bj\u0161\u00ed s\u00edt\u011b, nebo aplikovat specializovan\u00e9 re\u017eimy konfigurace tunel\u016f, kter\u00e9 vyu\u017e\u00edvaj\u00ed prostory jmen v Linuxu (network namespace). Pro experimenty s prov\u00e1d\u011bn\u00edm \u00fatoku byl publikov\u00e1n soubor skript\u016f.

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

Lze si pov\u0161imnout, \u017ee my\u0161lenka lok\u00e1ln\u00edho zm\u011bny routingu nen\u00ed nov\u00e1 a byla d\u0159\u00edve obvykle pou\u017e\u00edv\u00e1na v \u00fatoc\u00edch zam\u011b\u0159en\u00fdch na podvrh DNS serveru. V podobn\u00e9m \u00fatoku TunnelCrack, kde byla p\u0159esm\u011brov\u00e1na doprava prost\u0159ednictv\u00edm nahrazen\u00ed v\u00fdchoz\u00edho br\u00e1ny, se probl\u00e9m t\u00fdkal v\u0161ech ov\u011b\u0159en\u00fdch VPN klient\u016f pro iOS, 87,5% VPN klient\u016f pro macOS, 66,7% pro Windows, 35,7% pro Linux a 21,4% pro Android. V kontextu VPN a DHCP byla tato metoda tak\u00e9 zm\u00edn\u011bna d\u0159\u00edve, nap\u0159\u00edklad byla v\u011bnov\u00e1na jedna z p\u0159edn\u00e1\u0161ek na lo\u0148sk\u00e9 konferenci USENIX 2023 (v\u00fdzkum uk\u00e1zal, \u017ee 64,6% z 195 testovan\u00fdch VPN klient\u016f je n\u00e1chyln\u00fdch k \u00fatoku). <\/p>\n

Pro z\u00e1stupce tras bylo d\u0159\u00edve tak\u00e9 navr\u017eeno pou\u017e\u00edt speci\u00e1ln\u011b upraven\u00fd USB kl\u00ed\u010d, kter\u00fd simuluje pr\u00e1ci s\u00ed\u0165ov\u00e9ho adapt\u00e9ru, kter\u00fd se p\u0159i p\u0159ipojen\u00ed k po\u010d\u00edta\u010di pomoc\u00ed DHCP prohla\u0161uje za br\u00e1nu. Krom\u011b toho, p\u0159i existenci kontroly nad br\u00e1nou (nap\u0159\u00edklad p\u0159i p\u0159ipojen\u00ed ob\u011bti k ovl\u00e1dan\u00e9 \u00fato\u010dn\u00edkem bezdr\u00e1tov\u00e9 s\u00edti) byla vyvinuta technika vkl\u00e1d\u00e1n\u00ed paket\u016f do tunelu, kter\u00e9 jsou vn\u00edm\u00e1ny v kontextu s\u00ed\u0165ov\u00e9ho rozhran\u00ed VPN. <\/p>\n

Toky dat p\u0159i pou\u017eit\u00ed VPN:

\"\u00datok<\/center> <\/p>\n

Tiky dat po proveden\u00ed \u00fatoku:

\"\u00datok<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok TunnelVision, kter\u00fd umo\u017e\u0148uje p\u0159esm\u011brovat VPN dopravu prost\u0159ednictv\u00edm manipulac\u00ed s DHCP | ProHoster","description":"Ve\u0159ejnosti byl p\u0159edlo\u017een metod \u00fatoku TunnelVision, umo\u017e\u0148uj\u00edc\u00ed p\u0159i m\u00edt p\u0159\u00edstup k lok\u00e1ln\u00ed s\u00edti nebo kontrolu nad bezdr\u00e1tovou s\u00edt\u00ed, p\u0159esm\u011brovat na sv\u016fj host trafiku ob\u011bti obch\u00e1zen\u00edm VPN (m\u00edsto.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c VPN-\u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 DHCP | ProHoster","og:description":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-07T11:52:19+00:00","article:modified_time":"2024-05-07T11:52:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115607","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 23:52:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/115607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=115607"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/115607\/revisions"}],"predecessor-version":[{"id":156765,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/115607\/revisions\/156765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/115608"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=115607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=115607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=115607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}