{"id":115607,"date":"2024-05-07T13:52:17","date_gmt":"2024-05-07T11:52:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp"},"modified":"2024-05-07T13:52:17","modified_gmt":"2024-05-07T11:52:19","slug":"ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","title":{"rendered":"Ataque TunnelVision, que permite redirecionar o tr\u00e1fego VPN atrav\u00e9s de manipula\u00e7\u00f5es com DHCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Foi proposto ao p\u00fablico o m\u00e9todo de ataque TunnelVision, que permite, tendo acesso \u00e0 rede local ou controle sobre a rede sem fio, redirecionar o tr\u00e1fego da v\u00edtima para seu pr\u00f3prio host, contornando o VPN (em vez de ser enviado atrav\u00e9s do VPN, o tr\u00e1fego ser\u00e1 enviado em texto claro, sem tunelamento para o sistema do atacante). A vulnerabilidade afeta qualquer cliente VPN que n\u00e3o utiliza espa\u00e7os de nomes de rede isolados (network namespace) ao direcionar o tr\u00e1fego para o t\u00fanel ou que n\u00e3o aplica regras de filtragem de pacotes durante a configura\u00e7\u00e3o do t\u00fanel que impe\u00e7am a rotea\u00e7\u00e3o do tr\u00e1fego VPN atrav\u00e9s das interfaces de rede f\u00edsicas existentes. <\/p>\n

A ess\u00eancia do ataque reside no fato de que o atacante pode iniciar seu pr\u00f3prio servidor DHCP e us\u00e1-lo para fornecer ao cliente informa\u00e7\u00f5es para alterar a rotea\u00e7\u00e3o. Em particular, o atacante pode tirar proveito da op\u00e7\u00e3o 121 fornecida pelo protocolo DHCP (RFC-3442, adotada em 2002), destinada \u00e0 transmiss\u00e3o de informa\u00e7\u00f5es sobre rotas est\u00e1ticas, para fazer altera\u00e7\u00f5es na tabela de roteamento da m\u00e1quina da v\u00edtima e redirecionar o tr\u00e1fego. VPN<\/a>O redirecionamento \u00e9 realizado por meio da configura\u00e7\u00e3o de uma s\u00e9rie de rotas para sub-redes com prefixo \/1, que t\u00eam prioridade mais alta do que a rota padr\u00e3o com prefixo \/0 (0.0.0.0\/0); portanto, o tr\u00e1fego, em vez de ser enviado pela interface de rede virtual destinada ao VPN, ser\u00e1 redirecionado atrav\u00e9s da interface de rede f\u00edsica para o host do atacante na rede local. <\/p>\n

O ataque pode ser realizado em qualquer sistema operacional que suporte a op\u00e7\u00e3o 121 do DHCP, incluindo Linux, Windows, iOS e macOS, independentemente do protocolo VPN utilizado (Wireguard, OpenVPN, IPsec) e do conjunto de cifrados. A plataforma Android n\u00e3o \u00e9 vulner\u00e1vel ao ataque, pois n\u00e3o processa a op\u00e7\u00e3o 121 no DHCP. No entanto, o ataque permite o acesso ao tr\u00e1fego, mas n\u00e3o possibilita a intercep\u00e7\u00e3o de conex\u00f5es ou a identifica\u00e7\u00e3o do conte\u00fado transmitido usando protocolos seguros de n\u00edvel de aplica\u00e7\u00e3o, como TLS e SSH; por exemplo, o atacante n\u00e3o pode identificar o conte\u00fado das solicita\u00e7\u00f5es HTTPS, mas pode entender a quais servidores elas est\u00e3o sendo enviadas. <\/p>\n

Para se proteger contra ataques, \u00e9 poss\u00edvel proibir no n\u00edvel do filtro de pacotes o envio de pacotes destinados \u00e0 interface VPN atrav\u00e9s de outras interfaces de rede; bloquear pacotes DHCP com a op\u00e7\u00e3o 121; usar VPN dentro de uma m\u00e1quina virtual separada (ou cont\u00eainer) isolada da rede externa, ou aplicar modos especiais de configura\u00e7\u00e3o de t\u00faneis que utilizam espa\u00e7os de nomes no Linux (network namespace). Um conjunto de scripts foi publicado para experimentos com a realiza\u00e7\u00e3o de ataques.

\r\n \"Por\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

Vale ressaltar que a ideia de altera\u00e7\u00e3o local da rotea\u00e7\u00e3o n\u00e3o \u00e9 nova e foi normalmente utilizada em ataques focados na substitui\u00e7\u00e3o do servidor DNS. Em um ataque semelhante, o TunnelCrack, onde o redirecionamento do tr\u00e1fego era feito atrav\u00e9s da substitui\u00e7\u00e3o do gateway padr\u00e3o, o problema afetava todos os clientes VPN testados para iOS, 87,5% dos clientes VPN para macOS, 66,7% para Windows, 35,7% para Linux e 21,4% para Android. No contexto de VPN e DHCP, o m\u00e9todo tamb\u00e9m foi mencionado anteriormente, por exemplo, um dos relat\u00f3rios na confer\u00eancia USENIX 2023 focou nisso (a pesquisa mostrou que 64,6% dos 195 clientes VPN testados estavam vulner\u00e1veis ao ataque). <\/p>\n

Para a inser\u00e7\u00e3o de rotas, j\u00e1 foi sugerido o uso de um pen drive USB especialmente formatado, simulando o funcionamento de um adaptador de rede, que ao ser conectado ao computador, atrav\u00e9s do DHCP, se declara como gateway. Al\u00e9m disso, com controle sobre o gateway (por exemplo, ao conectar a v\u00edtima a uma rede sem fio controlada pelo atacante), foi desenvolvida uma t\u00e9cnica de inser\u00e7\u00e3o de pacotes no t\u00fanel, percebidos no contexto da interface de rede VPN. <\/p>\n

Fluxos de dados ao utilizar VPN:

\"Ataque<\/center> <\/p>\n

Fluxos de dados ap\u00f3s a realiza\u00e7\u00e3o do ataque:

\"Ataque<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ataque TunnelVision, que permite redirecionar o tr\u00e1fego VPN atrav\u00e9s de manipula\u00e7\u00f5es com DHCP | ProHoster","description":"O p\u00fablico foi apresentado ao m\u00e9todo de ataque TunnelVision, que permite, ao ter acesso \u00e0 rede local ou controle sobre a rede sem fio, redirecionar o tr\u00e1fego da v\u00edtima para seu pr\u00f3prio host, evitando o VPN (em vez de.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c VPN-\u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 DHCP | ProHoster","og:description":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-07T11:52:19+00:00","article:modified_time":"2024-05-07T11:52:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115607","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 23:52:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/115607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=115607"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/115607\/revisions"}],"predecessor-version":[{"id":156765,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/115607\/revisions\/156765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/115608"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=115607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=115607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=115607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}