{"id":115607,"date":"2024-05-07T13:52:17","date_gmt":"2024-05-07T11:52:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp"},"modified":"2024-05-07T13:52:17","modified_gmt":"2024-05-07T11:52:19","slug":"ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","title":{"rendered":"TunnelVision-attacken som m\u00f6jligg\u00f6r omdirigering av VPN-trafik genom manipulation av DHCP.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Metoden f\u00f6r TunnelVision-attacker har presenterats f\u00f6r allm\u00e4nheten, vilket m\u00f6jligg\u00f6r omdirigering av offrets trafik till sin egen v\u00e4rd utan VPN (ist\u00e4llet f\u00f6r att skicka trafik genom VPN, kommer trafiken att skickas \u00f6ppet utan tunneling till angriparens system) om det finns tillg\u00e5ng till det lokala n\u00e4tverket eller kontroll \u00f6ver det tr\u00e5dl\u00f6sa n\u00e4tverket. Problemet drabbar alla VPN-klienter som inte anv\u00e4nder isolerade n\u00e4tverksnamnrymder (network namespaces) n\u00e4r trafik dirigeras till tunneln eller som inte st\u00e4ller in paketfilterregler vid upps\u00e4ttning av tunneln som f\u00f6rbjuder routing av VPN-trafik genom befintliga fysiska n\u00e4tverksgr\u00e4nssnitt. <\/p>\n

Angreppets k\u00e4rna \u00e4r att angriparen kan starta sin egen DHCP-server och anv\u00e4nda den f\u00f6r att skicka information till klienten f\u00f6r att \u00e4ndra routing. Specifikt kan angriparen utnyttja DHCP-protokollets alternativ 121 (RFC-3442, antagen 2002), som \u00e4r avsedd att \u00f6verf\u00f6ra information om statiska rutter, f\u00f6r att g\u00f6ra \u00e4ndringar i routingtabellen p\u00e5 offrets maskin och styra trafiken f\u00f6rbi. VPN<\/a>Omdirigering sker genom att ange en serie rutter f\u00f6r subnet med prefixet \/1, som har h\u00f6gre prioritet \u00e4n den standardrutt som anv\u00e4nder prefixet \/0 (0.0.0.0\/0), vilket inneb\u00e4r att trafiken ist\u00e4llet f\u00f6r den angivna VPN virtuella n\u00e4tverksgr\u00e4nssnittet kommer att skickas via det fysiska n\u00e4tverksgr\u00e4nssnittet till angriparens v\u00e4rd inom det lokala n\u00e4tverket. <\/p>\n

Angreppet kan utf\u00f6ras p\u00e5 alla operativsystem som st\u00f6der DHCP alternativ 121, inklusive Linux, Windows, iOS och macOS, oavsett vilken VPN-protokoll som anv\u00e4nds (Wireguard, OpenVPN, IPsec) och upps\u00e4ttningen av krypteringsmetoder. Android-plattformen \u00e4r inte mottaglig f\u00f6r angreppet, eftersom den inte hanterar alternativ 121 i DHCP. I detta fall till\u00e5ter angreppet \u00e5tkomst till trafiken, men det ger inte m\u00f6jlighet att infiltrera anslutningar och best\u00e4mma inneh\u00e5llet som \u00f6verf\u00f6rs med hj\u00e4lp av s\u00e4krade protokoll p\u00e5 applikationsniv\u00e5, som TLS och SSH. Till exempel kan angriparen inte avg\u00f6ra inneh\u00e5llet i HTTPS-f\u00f6rfr\u00e5gningar, men kan f\u00f6rst\u00e5 till vilka servrar de skickas. <\/p>\n

F\u00f6r att skydda mot attacken kan man f\u00f6rbjuda pakets\u00e4ndning till VPN-gr\u00e4nssnittet via andra n\u00e4tverksgr\u00e4nssnitt p\u00e5 paketfilter-niv\u00e5; blockera DHCP-paket med alternativ 121; anv\u00e4nda VPN inuti en separat virtuell maskin (eller container) som \u00e4r isolerad fr\u00e5n det externa n\u00e4tverket, eller till\u00e4mpa speciella tunneldesigninst\u00e4llningar som anv\u00e4nder namnrymder i Linux (network namespace). En upps\u00e4ttning skript har publicerats f\u00f6r experiment med genomf\u00f6rande av attacken.

\r\n \"Spela\r\n
<\/div>\r\n <\/div> <\/center> <\/p>\n

Man kan notera att id\u00e9n om lokal routing\u00e4ndring inte \u00e4r ny och tidigare har anv\u00e4nts i attacker riktade mot DNS-serverutbyte. I en liknande attack, TunnelCrack, d\u00e4r trafik omdirigerades genom att \u00e4ndra standardgatewayen, p\u00e5verkades alla testade VPN-klienter f\u00f6r iOS, 87,5 % av VPN-klienterna f\u00f6r macOS, 66,7 % f\u00f6r Windows, 35,7 % f\u00f6r Linux och 21,4 % f\u00f6r Android. I kontexten av VPN och DHCP har metoden ocks\u00e5 n\u00e4mnts tidigare, till exempel i en presentation p\u00e5 f\u00f6rra \u00e5rets konferens USENIX 2023 (forskningen visade att 64,6 % av 195 testade VPN-klienter var s\u00e5rbara f\u00f6r attacken). <\/p>\n

F\u00f6r att infoga rutter f\u00f6reslogs det tidigare \u00e4ven att anv\u00e4nda en s\u00e4rskilt utformad USB-nyckel som simulerar en n\u00e4tverksadapter, vilken vid anslutning till en dator via DHCP utger sig f\u00f6r att vara en gateway. Dessutom, n\u00e4r det finns kontroll \u00f6ver gatewayen (till exempel om offret \u00e4r anslutet till en tr\u00e5dl\u00f6s n\u00e4tverk kontrollerad av angriparen) utvecklades en teknik f\u00f6r paketinfogning i tunneln, som uppfattas i kontexten av VPN-n\u00e4tverksgr\u00e4nssnittet. <\/p>\n

Datastreamar vid anv\u00e4ndning av VPN:

\"TunnelVision-attacken<\/center> <\/p>\n

Datastreamar efter att attacken genomf\u00f6rts:

\"TunnelVision-attacken<\/center>
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 VPN, \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0431\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043b\u044e\u0431\u044b\u0435 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u044b, \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b (network […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":115608,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 TunnelVision-attacken som m\u00f6jligg\u00f6r omdirigering av VPN-trafik genom manipulation av DHCP | ProHoster","description":"Tunneln TunnelVision har presenterats f\u00f6r allm\u00e4nheten, som m\u00f6jligg\u00f6r omdirigering av offerts trafik till sin egen v\u00e4rd i strid med VPN vid tillg\u00e5ng till det lokala n\u00e4tverket eller kontroll \u00f6ver det tr\u00e5dl\u00f6sa n\u00e4tverket.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c VPN-\u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 DHCP | ProHoster","og:description":"\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 TunnelVision, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0445\u043e\u0441\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0436\u0435\u0440\u0442\u0432\u044b \u0432 \u043e\u0431\u0445\u043e\u0434 VPN (\u0432\u043c\u0435\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-tunnelvision-pozvolyayushhaya-perenapravit-vpn-trafik-cherez-manipulyaczii-s-dhcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-05-07T11:52:19+00:00","article:modified_time":"2024-05-07T11:52:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115607","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:58:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 23:52:19","updated":"2026-02-04 14:58:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/115607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=115607"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/115607\/revisions"}],"predecessor-version":[{"id":156765,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/115607\/revisions\/156765"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/115608"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=115607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=115607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=115607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}