{"id":115607,"date":"2024-05-07T13:52:17","date_gmt":"2024-05-07T11:52:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp"},"modified":"2024-05-07T13:52:17","modified_gmt":"2024-05-07T11:52:19","slug":"ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","title":{"rendered":"Atacul TunnelVision, care permite redirec\u021bionarea traficului VPN prin manipul\u0103ri DHCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Metoda de atac TunnelVision este propus\u0103 publicului, permi\u021b\u00e2nd, \u00een cazul \u00een care exist\u0103 acces la re\u021beaua local\u0103 sau control asupra re\u021belei wireless, redirec\u021bionarea traficului victimei c\u0103tre propriul s\u0103u gazd\u0103, ocolind VPN-ul (\u00een loc s\u0103 fie trimis prin VPN, traficul va fi trimis \u00een mod deschis, f\u0103r\u0103 tunelare c\u0103tre sistemul atacatorului). Problema afecteaz\u0103 orice clien\u021bi VPN care nu utilizeaz\u0103 spa\u021bii de nume izolate ale sub-sistemului de re\u021bea (network namespace) atunci c\u00e2nd redirec\u021bioneaz\u0103 traficul \u00een tunel sau care nu stabilesc reguli de filtrare a pachetelor care interzic rutarea traficului VPN prin interfe\u021bele de re\u021bea fizice existente. <\/p>\n

Sunt esen\u021ba atacului faptul c\u0103 atacatorul poate lansa propriul s\u0103u server DHCP \u0219i \u00eel poate folosi pentru a transmite clientului informa\u021bii pentru a modifica rutarea. \u00cen special, atacatorul poate profita de op\u021biunea 121 furnizat\u0103 \u00een protocolul DHCP (RFC-3442, adoptat \u00een 2002), destinat transmiterii informa\u021biilor despre rutele statice, pentru a efectua modific\u0103ri \u00een tabela de rutare a ma\u0219inii victimei \u0219i a direc\u021biona traficul ocolind VPN<\/a>. Redirec\u021bionarea se realizeaz\u0103 prin stabilirea unei serii de rute pentru subre\u021bele cu prefixul \/1, care au prioritate mai mare dec\u00e2t ruta implicit\u0103 cu prefixul \/0 (0.0.0.0\/0); astfel, traficul, \u00een loc s\u0103 fie direc\u021bionat prin interfa\u021ba de re\u021bea virtual\u0103 pentru VPN, va fi direc\u021bionat prin interfa\u021ba de re\u021bea fizic\u0103 c\u0103tre gazda atacatorului \u00een re\u021beaua local\u0103. <\/p>\n

Atacul poate fi realizat pe orice sistem de operare care suport\u0103 op\u021biunea 121 a DHCP, inclusiv Linux, Windows, iOS \u0219i macOS, indiferent de protocolul VPN utilizat (Wireguard, OpenVPN, IPsec) \u0219i setul de criptare. Platforma Android nu este vulnerabil\u0103 la atac, deoarece nu prelucreaz\u0103 op\u021biunea 121 \u00een DHCP. Totu\u0219i, atacul permite accesul la trafic, dar nu ofer\u0103 posibilitatea de a interveni \u00een conexiuni \u0219i de a determina con\u021binutul transmis prin protocoale de aplica\u021bie securizate, cum ar fi TLS \u0219i SSH; de exemplu, atacatorul nu poate determina con\u021binutul cererilor HTTPS, dar poate \u00een\u021belege c\u0103tre ce servere sunt trimise. <\/p>\n

Pentru a proteja \u00eempotriva atacurilor, este posibil s\u0103 interzicem, la nivelul filtrului de pachete, trimiterea pachetelor adresate interfe\u021bei VPN prin alte interfe\u021be de re\u021bea; s\u0103 bloc\u0103m pachetele DHCP cu op\u021biunea 121; s\u0103 utiliz\u0103m VPN \u00eentr-o ma\u0219in\u0103 virtual\u0103 separat\u0103 (sau container), izolat\u0103 de re\u021beaua extern\u0103, sau s\u0103 aplic\u0103m moduri speciale de configurare a tunelurilor folosing spa\u021biile de nume din Linux (network namespace). Pentru experimente privind atacurile, a fost publicat un set de scripturi.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

Se poate observa c\u0103 ideea de modificare local\u0103 a rut\u0103rii nu este nou\u0103 \u0219i a fost utilizat\u0103 anterior \u00een atacuri menite s\u0103 \u00eenlocuieasc\u0103 serverul DNS. \u00centr-un atac similar, TunnelCrack, unde redirec\u021bionarea traficului se f\u0103cea prin \u00eenlocuirea gateway-ului implicit, problema afecta toate clien\u021bii VPN verifica\u021bi pentru iOS, 87,5% din clien\u021bii VPN pentru macOS, 66,7% pentru Windows, 35,7% pentru Linux \u0219i 21,4% pentru Android. \u00cen contextul VPN \u0219i DHCP, metoda a fost men\u021bionat\u0103 anterior, de exemplu, fiind dedicat unul dintre articolele de la conferin\u021ba USENIX 2023 de anul trecut (cercetarea a ar\u0103tat c\u0103 64,6% dintre cei 195 de clien\u021bi VPN testa\u021bi erau vulnerabili la atac). <\/p>\n

Pentru substituirea rutelor, anterior s-a propus utilizarea unui USB special conceput, care simuleaz\u0103 func\u021bionarea unui adaptor de re\u021bea, care, la conectarea la un computer prin DHCP, se declar\u0103 a fi gateway. \u00cen plus, \u00een cazul \u00een care exist\u0103 control asupra gateway-ului (de exemplu, prin conectarea victimei la o re\u021bea wireless controlat\u0103 de atacator), a fost dezvoltat\u0103 o tehnic\u0103 de substituire a pachetelor \u00een tunel, percepute \u00een contextul interfe\u021bei de re\u021bea VPN. <\/p>\n

Fluxurile de date atunci c\u00e2nd se utilizeaz\u0103 VPN:

\"Atacul<\/center> <\/p>\n

Fluxurile de date dup\u0103 realizarea atacului:

\"Atacul<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul TunnelVision, care permite redirec\u021bionarea traficului VPN prin manipularea DHCP | ProHoster","description":"Metoda de atac TunnelVision a fost propus\u0103 publicului, permi\u021b\u00e2nd, \u00een prezen\u021ba accesului la re\u021beaua local\u0103 sau controlului asupra re\u021belei wireless, redirec\u021bionarea traficului victimei c\u0103tre propriul s\u0103u host, ocolind VPN.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c VPN-\u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 DHCP | ProHoster","og:description":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-07T11:52:19+00:00","article:modified_time":"2024-05-07T11:52:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115607","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 23:52:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=115607"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115607\/revisions"}],"predecessor-version":[{"id":156765,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115607\/revisions\/156765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/115608"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=115607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=115607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=115607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}