TunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables
No ratings
Presented at BlackHat Europe 2023 by
We will present two new attacks to leak traffic sent by a VPN client. A rogue Wi-Fi network can abuse these vulnerabilities to make the victim leak IP packets, in plaintext, outside the VPN tunnel. The adversary accomplishes this by manipulating the victim's routing table. Our attacks are independent of the VPN protocol being used, meaning they apply to IPsec, OpenVPN, WireGuard, etc.Our first attack exploits VPN clients that allow access to the local network. The attacker must create a rogue Wi-Fi network and will, briefly summarized, pretend that the local network is the whole Internet. As a result, if the victim visits a website, the VPN client will think the website is hosted in the local network and won't send the resulting HTTP request through the VPN tunnel. We tested 126 free, paid, and built-in VPNs on various platforms, and 65% were vulnerable to this attack. Surprisingly, all VPN clients on iOS were vulnerable, and Android clients were the most secure.Our second attack exploits that VPN clients don't encrypt traffic to the VPN server itself. This avoids routing loops where packets get encrypted again and again. We show how to abuse this behavior to leak arbitrary traffic. We found that built-in and enterprise VPNs were especially vulnerable to this attack.