Technology

59298 readers

4871 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

497

Novel attack against virtually all VPN apps neuters their entire purpose (arstechnica.com)

submitted 6 months ago by jeffw@lemmy.world to c/technology@lemmy.world

133 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] Max_P@lemmy.max-p.me 21 points 6 months ago (1 children)

That's why half decent VPN apps also add firewall rules to prevent leakage. Although nothing can beat Linux and shoving the real interface in a namespace so it's plainly not available to anything except the VPN process.

[–] r00ty@kbin.life 5 points 6 months ago (2 children)

Yes, I don't agree with the no way to mitigate statement.

I suspect on windows the only real defence is something like.

Check if the network has suspicious multiple routes setup from the DHCP
If so, either use the IP/Mask/Gateway with manual IP config (to not receive the CIDR routes) or steer clear of an at best questionable network entirely.
Maybe use the windows firewall to block all traffic outbound EXCEPT from the firewall program (with perhaps exceptions for local networks as per below linux example). For whatever reason the windows firewall doesn't seem to have a way to specify an interface. But you can specify a program.

I did look for some way to control Window's handling of DHCP options. But it seems there isn't anything obvious to limit this otherwise. I do not know if the windows firewall has this kind of fine-grained control with its own fire

For linux, I used to have my own blackout firewall rules. That only allowed the specific LAN range (for mobile use you could include all RFC1918 ranges) and the specific VPN IP out of the internet facing interface. Only the VPN interface could otherwise access the internet.

[–] Max_P@lemmy.max-p.me 3 points 6 months ago* (last edited 6 months ago)

Some providers have managed to make split tunnelling work fine so those I suspect are not affected because they override the routing at the driver level. It's really only the kinda lame OpenVPN wrappers that would be affected. When you have the custom driver, you can affect the routing. It's been a while since I've tested this stuff on Windows since obviously I haven't been paid to do that for 6 years, but yeah I don't even buy that all providers are affected and that it's unfixable. We had workarounds for that when I joined PIA already so it's probably been a known thing for at least a decade.

The issues we had is sometimes you could get the client to forget to remove the firewall rules or to add back the routes and it would break people's internet entirely. Not great but a good problem to have in context.

[–] masterofn001@lemmy.ca 1 points 6 months ago

I've never checked the box, when I set address and DNS to manual and add my own routes, not dhcp inherited

ignore automatically provided routes

Would seem like a thing to do now?