497
Novel attack against virtually all VPN apps neuters their entire purpose (arstechnica.com)
submitted 2 years ago by to c/technology@lemmy.world
127 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 60 points 2 years ago (1 child)

My understanding is that if you run a rogue discoverable DHCP server in a local network with a particular set of options set and hyper-specific routing rules, you can clobber the routing rules set by the VPN software on any non-Android device, and route all traffic from those devices through arbitrary midpoints that you control.

But IANANE (I am not a network engineer) so please correct my misinterpretations.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 32 points 2 years ago (4 children)

    this implies physical access or at least access within the network?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 49 points 2 years ago (1 child)

    Keeping in mind that may mean that somebody like a cellular provider could do so. Since your local network in that context would be them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 25 points 2 years ago (1 child)

    Exactly. And if your ISP or cellular provider wants, or is forced, to gather information about your internet activities, they can almost certainly find a way. The cheap consumer-grade VPN services most of us use just prevent casual or automated observers from easily detecting your device's IP address. For most people that just want to torrent casually or use public wifi, it's enough.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •