Security researchers have discovered an exploit called TunnelVision that can render any VPN useless, allowing attackers to snoop on unencrypted traffic and potentially gain valuable data. The researchers suspect that the exploit may have been used for years, and they notified VPN makers about their findings. Fixing the issue is challenging, as removing DHCP support in VPNs would cause connectivity problems, and other proposed fixes still leave room for de-anonymized traffic.
The vulnerability, assigned CVE-2024-3661, has been available for exploitation since 2002 but has no known cases of active exploitation. Mitigation measures include using network namespaces, configuring VPN clients to deny non-VPN traffic, ignoring DHCP option 121, connecting via personal hotspots or virtual machines, and avoiding untrusted networks. VPN providers are encouraged to enhance client software to block risky DHCP configurations.
The researchers warn that relying on compromised networks with VPNs could have serious consequences, especially for individuals who rely on VPNs for safety, such as journalists and whistleblowers.
Why do we care?
This is a significant problem. Heads up for infrastructure and security teams to get up to speed and mitigate the problem.