{"id":115607,"date":"2024-05-07T13:52:17","date_gmt":"2024-05-07T11:52:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp"},"modified":"2024-05-07T13:52:17","modified_gmt":"2024-05-07T11:52:19","slug":"ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","title":{"rendered":"TunnelVision r\u00fcnnak, mis v\u00f5imaldab VPN-i liikluse suunamist DHCP manipuleerimise kaudu.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avalikkusele pakutakse r\u00fcnnakumeetodit TunnelVision, mis v\u00f5imaldab, kui on juurdep\u00e4\u00e4s kohalikule v\u00f5rgule v\u00f5i kontroll nende traadita v\u00f5rkude \u00fcle, suunata sihtm\u00e4rgi liiklus r\u00fcndaja hosti, v\u00e4ltides VPN-i (liiklus saadetakse avatud kujul, mitte tunneli kaudu r\u00fcndaja s\u00fcsteemi). Probleem on seotud k\u00f5igi VPN-klientidega, mis ei kasuta v\u00f5rgu alamruumide isoleeritud nimesid (network namespace) liikluse tunnelisse suunamisel v\u00f5i ei m\u00e4\u00e4ra tunnelit seadistades paketifiltreerimise reegleid, mis keelavad VPN-liikluse suunamise olemasolevate f\u00fc\u00fcsiliste v\u00f5rguliideste kaudu. <\/p>\n

R\u00fcnnaku sisuks on see, et r\u00fcndaja saab k\u00e4ivitada oma DHCP-serveri ja kasutada seda teabe edastamiseks kliendile, et muuta marsruutimist. Eriti v\u00f5ib r\u00fcndaja kasutada DHCP protokollis esitatud valikut 121 (RFC-3442, vastu v\u00f5etud 2002. aastal), mis on m\u00f5eldud staatiliste marsruutide teabe edastamiseks, et teha muudatusi sihtm\u00e4rgi masina marsruuditabelis ja suunata liiklust m\u00f6\u00f6da. VPN<\/a>. Suunamine toimub alamv\u00f5rkudele esitatud marsruutide seeriaga, millel on prefiks \/1, mis omavad k\u00f5rgemat prioriteeti kui vaikimisi kasutatav marsruut prefiksiga \/0 (0.0.0.0\/0), seega liiklus suunatakse VPN-i virtuaalse v\u00f5rguliidese asemel f\u00fc\u00fcsilise v\u00f5rguliidese kaudu r\u00fcndaja hosti kohalikus v\u00f5rgus. <\/p>\n

R\u00fcnnakut saab teostada k\u00f5ikides operatsioonis\u00fcsteemides, mis toetavad DHCP valikut 121, sealhulgas Linux, Windows, iOS ja macOS, s\u00f5ltumata kasutatavast VPN-protokollist (Wireguard, OpenVPN, IPsec) ja kr\u00fcptimise komplektist. Androidi platvorm ei ole r\u00fcnnakule vastuv\u00f5tlik, kuna see ei t\u00f6\u00f6tle DHCP valikut 121. Sellegipoolest v\u00f5imaldab r\u00fcnnak p\u00e4\u00e4seda ligi liiklusele, kuid ei v\u00f5imalda sekkuda \u00fchendustesse ja m\u00e4\u00e4rata sisu, mis edastatakse kaitstud rakendusprotokollide, nagu TLS ja SSH, kaudu; n\u00e4iteks ei saa r\u00fcndaja m\u00e4\u00e4rata HTTPS-p\u00e4ringute sisu, kuid ta suudab m\u00f5ista, millistele serveritele need saadetakse. <\/p>\n

R\u00fcnnaku eest kaitsmiseks saab keelata paketifiltri tasandil VPN-liidesele adresseeritud paketid kaudu teiste v\u00f5rguliideste saatmise; blokeerida DHCP-paketid valikuga 121; kasutada VPN-i eraldi virtuaalmasinas (v\u00f5i konteineris), mis on isoleeritud v\u00e4listest v\u00f5rkudest, v\u00f5i rakendada spetsiaalseid tunneli seadistamise re\u017eiime, mis kasutavad Linuxi nimesid (network namespace). R\u00fcnnaku katsetamiseks on avaldatud komplekt skripte.

\r\n \"Vaata\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

On m\u00e4rkimisv\u00e4\u00e4rne, et ideed lokaalsete marsruutide muutmiseks ei ole uus ja seda on varem tavaliselt kasutatud r\u00fcnnakutes, mis on suunatud DNS-serveri t\u00e4iendamisele. Sarnases r\u00fcnnakus TunnelCrack, kus liikluse suunamine toimus vaikimisi marsruudi vahetamise kaudu, oli probleem seotud k\u00f5igi testitud VPN-klientidega iOS-i jaoks, 87,5% VPN-klientidest macOS-i jaoks, 66,7% Windowsi jaoks, 35,7% Linuxi jaoks ja 21,4% Androidi jaoks. VPN-i ja DHCP kontekstis on meetodit mainitud ka varem, n\u00e4iteks oli sellele p\u00fchendatud \u00fcks ettekandeid m\u00f6\u00f6dunud aasta USENIX 2023 konverentsil (uurimus n\u00e4itas, et 64,6% 195 testitud VPN-klientidest on r\u00fcnnakule vastuv\u00f5tlikud). <\/p>\n

Marsruutide asendamiseks on varem pakutud ka spetsiaalselt kujundatud USB-m\u00e4lupulka, mis simuleerib v\u00f5rgukaardi t\u00f6\u00f6d, teavitades end DHCP kaudu kui marsruudi andjat, kui see on arvutiga \u00fchendatud. Lisaks, kui on kontroll marsruudi \u00fcle (n\u00e4iteks kui sihtm\u00e4rk on \u00fchendatud r\u00fcndaja kontrollitava traadita v\u00f5rguga), on v\u00e4lja t\u00f6\u00f6tatud pakettide asendamise tehnika tunnelisest, mis on vastu v\u00f5etud VPN-i v\u00f5rguliideste kontekstis. <\/p>\n

Andmevood VPN-i kasutamisel:

\"TunnelVision<\/center> <\/p>\n

Andmevood p\u00e4rast r\u00fcnnaku sooritamist:

\"TunnelVision<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TunnelVision r\u00fcnnak, mis v\u00f5imaldab VPN-liiklust suunata DHCP manipuleerimise kaudu | ProHoster","description":"Avalikkusele pakutakse r\u00fcnnakumeetodit TunnelVision, mis v\u00f5imaldab, kui on juurdep\u00e4\u00e4s kohalikule v\u00f5rgule v\u00f5i kontroll nende traadita v\u00f5rkude \u00fcle, suunata sihtm\u00e4rgi liiklus r\u00fcndaja hosti, v\u00e4ltides VPN-i (liiklus saadetakse avatud kujul, mitte tunneli kaudu r\u00fcndaja s\u00fcsteemi). Probleem on seotud k\u00f5igi VPN-klientidega, mis ei kasuta v\u00f5rgu alamruumide isoleeritud nimesid (network","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c VPN-\u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 DHCP | ProHoster","og:description":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-07T11:52:19+00:00","article:modified_time":"2024-05-07T11:52:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115607","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 23:52:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115607"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115607\/revisions"}],"predecessor-version":[{"id":156765,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115607\/revisions\/156765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/115608"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}