TunnelVision: The New VPN Bypass Technique Exposing Users to Surveillance

Leviathan Security researchers have unearthed a groundbreaking method of breaching VPN encapsulation, dubbed TunnelVision, allowing malicious actors to covertly intercept users’ traffic. This innovative attack leverages inherent features of DHCP (Dynamic Host Configuration Protocol) to divert a target’s traffic away from the VPN tunnel.

The crux of TunnelVision lies in its ability to exploit a DHCP design flaw, CVE-2024-3661, which renders certain messages, such as the classless static route (option 121), vulnerable to manipulation by attackers. By manipulating routing tables through DHCP messages, threat actors can reroute VPN traffic, evading encryption and exposing sensitive data to surveillance.

Attackers can achieve this by becoming the DHCP server for targeted users through various means such as DHCP starvation attacks or ARP spoofing. Once in control, they can manipulate routing tables to intercept VPN traffic, leaving it vulnerable to snooping, a process referred to as “decloaking.” Despite the attack, the VPN control channel remains active, and users appear connected to the VPN. The attackers achieve this by running a DHCP server on the same network as the targeted user and configuring it to use itself as a gateway, allowing them to snoop on the traffic passing through.