search

ivpn / desktop-app

Official IVPN Desktop app
https://www.ivpn.net/apps/
GNU General Public License v3.0
351 stars 48 forks source link

TunnelVision security vulnerability for all VPN apps #374

Closed TimmyBoi155 closed 4 months ago

TimmyBoi155 commented 4 months ago

Have IVPN team seen this? Is this being mitigated?

https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ https://www.leviathansecurity.com/blog/tunnelvision

stenya commented 4 months ago

We are aware of this research, and we are investigating the findings before a full response.

stenya commented 4 months ago

To exploit the vulnerability in question an attacker needs to connect to the same local network as the target, and act as a DHCP server. This allows them to modify routing tables and control traffic routing. This way they may route traffic outside of the VPN tunnel, bypassing the routing rules defined by the VPN client. As this vulnerability alters the routing table, it is not a discrete attack, if you can check your routing table you can tell whether the network is compromised.

Overview of our findings regarding IVPN apps:

1. IVPN Android app is not affected.

2. IVPN iOS app is potentially affected based on our assessment, and "Block LAN traffic" option enabled in the app does not mitigate the issue. Actions you can take if you are concerned about the attack:

3. For IVPN desktop apps we have a firewall functionality that blocks all traffic going outside the VPN interface. With the default configuration, IVPN users are not affected by this vulnerability.

However, the vulnerability might affect you if:

stenya commented 4 months ago

https://www.reddit.com/r/IVPN/comments/1clwlup/tunnelvision_vulnerability/

TimmyBoi155 commented 4 months ago

@stenya Is there any plan at all to fix this??

However, the vulnerability might affect you if:

* Firewall functionality is disabled

* Firewall is configured to allow LAN communication, or if there are custom firewall exceptions defined
  If you are concerned about this issue we suggest always using the built-in firewall in the desktop apps with default configuration.
stenya commented 4 months ago

Actually, the IVPN Firewall was designed to protect users from such types of attacks, and it is effectively doing its job. It is enabled by default. Users should be aware of the potential risks when they manually disable the firewall.

We are consistently seeking improvements. However, at present, there is no superior solution that would not impact user usability.