{"id":115607,"date":"2024-05-07T13:52:17","date_gmt":"2024-05-07T11:52:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp"},"modified":"2024-05-07T13:52:17","modified_gmt":"2024-05-07T11:52:19","slug":"ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","title":{"rendered":"TunnelVisioni r\u00fcnnak, mis v\u00f5imaldab suunata VPN-i liiklust l\u00e4bi DHCP manipuleerimise","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldamiseks on esitatud r\u00fcnnaku meetod TunnelVision, mis v\u00f5imaldab, kui on juurdep\u00e4\u00e4s kohaliku v\u00f5rgu v\u00f5i juhtimine traadita v\u00f5rgu \u00fcle, suunata ohvri liikluse oma hostile VPN-ist m\u00f6\u00f6da (liikluse saatmine toimub avatud kujul, ilma r\u00fcnnaku tunneldamiseta r\u00fcndaja s\u00fcsteemi). Probleem on seotud k\u00f5igi VPN-i klientidega, mis ei kasuta v\u00f5rgu alams\u00fcsteemi isoleeritud nimesid (network namespace) liikluse suunamisel tunnelisse v\u00f5i ei sea tunnelite seadistamisel pakettfiltri reegleid, mis keelavad VPN-i liikluse suunamise olemasolevatele f\u00fc\u00fcsilistele v\u00f5rgu liideste. <\/p>\n

R\u00fcnnaku olemus seisneb selles, et r\u00fcndaja v\u00f5ib k\u00e4ivitada oma DHCP-serveri ja kasutada seda kliendile teabe edastamiseks marsruudi muutmiseks. Eriti v\u00f5ib r\u00fcndaja kasutada DHCP protokollis esitatud valikut 121 (RFC-3442, vastuv\u00f5etud 2002. aastal), mis on m\u00f5eldud staatiliste marsruutide teabe edastamiseks, et muuta ohvri masina marsreidi tabelit ja suunata liiklust m\u00f6\u00f6da. VPN<\/a>. Suunamine toimub, kui luuakse seeria marsrulesid alamv\u00f5rkudele eesliitega \/1, mis on k\u00f5rgema prioriteediga kui vaikimisi marsruut eesliitekega \/0 (0.0.0.0\/0); seega liiklus, mitte m\u00e4\u00e4ratud VPN-i virtuaalsele v\u00f5rgu liidesele, suunatakse f\u00fc\u00fcsilise v\u00f5rgu liidese kaudu r\u00fcndaja hostile kohalikus v\u00f5rgus. <\/p>\n

R\u00fcnnakut saab teostada k\u00f5ikides ops\u00fcsteemides, mis toetavad DHCP valikut 121, sealhulgas Linux, Windows, iOS ja macOS, olenemata kasutatavast VPN-protokollist (Wireguard, OpenVPN, IPsec) ja kr\u00fcpto komplektist. Android platvorm ei ole r\u00fcnnakutele vastuv\u00f5tlik, kuna ei t\u00f6\u00f6tle DHCP valikut 121. Samas v\u00f5imaldab r\u00fcnnak p\u00e4\u00e4seda ligi liiklusele, kuid ei anna v\u00f5imalust sekkuda \u00fchendustesse ja m\u00e4\u00e4rata edastatavat sisu, kasutades rakendustasandi kaitstud protokolle, nagu TLS ja SSH, n\u00e4iteks ei saa r\u00fcndaja m\u00e4\u00e4rata HTTPS-i p\u00e4ringute sisu, kuid v\u00f5ib aru saada, millistele serveritele need saadetakse. <\/p>\n

R\u00fcnde kaitsmiseks saab keelata paki filtreerimise tasemel VPN-liidesele adresseeritud pakettide saatmise teistele v\u00f5rgu liideste kaudu; blokeerida DHCP-pakette, millel on valik 121; kasutada VPN-i eraldi virtuaalmasinas (v\u00f5i konteineris), mis on isoleeritud v\u00e4lisest v\u00f5rgust, v\u00f5i rakendada spetsiaalseid tunnelite seadistamise re\u017eiime, mis kasutavad Linuxis nimes\u00fcsteeme (network namespace). R\u00fcnnakute l\u00e4biviimise katsetamiseks on avaldatud skriptide kogum.

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

V\u00f5ib m\u00e4rkida, et kohaliku marsruutimise muutmise idee ei ole uus ja seda on varem tavaliselt kasutatud DNS-serveri petmiseks suunatud r\u00fcnnakutes. Sarnases r\u00fcnnakus TunnelCrack, kus liiklus suunati \u00fcmber vaikimisi v\u00e4rava asendamise kaudu, puudutas probleem k\u00f5iki testitud VPN-kliente iOS jaoks, 87.5% macOS VPN-klientidest, 66.7% Windowsi, 35.7% Linuxi ja 21.4% Androidi jaoks. VPN-i ja DHCP kontekstis on meetodit mainitud ka varem, n\u00e4iteks p\u00fchendati sellele \u00fcks ettekandeid eelmisel aastal toimunud USENIX 2023 konverentsil (uurimus n\u00e4itas, et 64.6% 195 testitud VPN-kliendist olid r\u00fcnnaku suhtes haavatavad). <\/p>\n

Marsruutide asendamiseks on varem pakutud kasutada spetsiaalselt disainitud USB-m\u00e4lupulka, mis simuleerib v\u00f5rguadapteri t\u00f6\u00f6d, mis, kui see on arvutiga \u00fchendatud, kuulutab ennast DHCP kaudu v\u00e4ravaks. Lisaks, kui v\u00e4rava \u00fcle on kontroll (n\u00e4iteks kui ohver on \u00fchendatud r\u00fcndaja juhitud traadita v\u00f5rku), on v\u00e4lja t\u00f6\u00f6tatud pakettide asendamise meetod tunnelis, mida tajutakse VPN-v\u00f5rgu liidese kontekstis. <\/p>\n

Andmevood VPN-i kasutamisel:

\"TunnelVisioni<\/center> <\/p>\n

Andmevood p\u00e4rast r\u00fcnnaku sooritamist:

\"TunnelVisioni<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TunnelVision r\u00fcnnak, mis v\u00f5imaldab suunata VPN-i liiklust DHCP manipuleerimise kaudu | ProHoster","description":"Avalikkusele on esitatud r\u00fcnnakumeetod TunnelVision, mis v\u00f5imaldab kohaliku v\u00f5rgu juurdep\u00e4\u00e4su v\u00f5i traadita v\u00f5rgu \u00fcle kontrolli korral suunata ohvri liikluse oma hostile VPN-i \u00fcmbersuunamisena (kui).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c VPN-\u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 DHCP | ProHoster","og:description":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-07T11:52:19+00:00","article:modified_time":"2024-05-07T11:52:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115607","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 23:52:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115607"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115607\/revisions"}],"predecessor-version":[{"id":156765,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115607\/revisions\/156765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/115608"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}