New Technique Lets You Spy on VPN Traffic
The technical approach under the name TunnelVision allows cybercriminals to view their victims' traffic without the need for any VPN system.
A cybersecurity firm called Leviathan Security Group has warned about a technique that allows attackers to bypass VPN systems and enable them to monitor victims' traffic by exploiting a flaw in the DHCP feature.
Named TunnelVision, this attacker technique relies on modifying routing tables and can be used without compromising the DHCP server's security. This technique exploits a security vulnerability in the DHCP design (CVE-2024-3661), where messages are not authenticated and are susceptible to manipulation.
NIST warns that "an attack with the ability to send DHCP messages could manipulate routes to reroute VPN traffic, allowing an attacker to read, interrupt, or possibly alter network traffic that should be protected by a VPN."
The cybersecurity firm explains that the vulnerability allows a local attacker to redirect traffic from a VPN to the local network.
Source: New Technique Allows You to Spy on VPN Traffic (itsecurity.pt)