Researchers from New York University and KU Leuven have developed two new attacks collectively named ‘TunnelCrack’ that can cause a broad range of VPN clients to leak user traffic outside the protected encryption tunnels.
The two attacks, ‘LocalNet’ and ‘ServerIP,’ stem from how VPN clients configure the underlying OS to route traffic through VPN tunnels by updating the system’s IP routing tables. The OS retains some exceptions for local network communications and for direct data exchange between the VPN client and the VPN server. The researchers discovered that it’s possible to manipulate exceptions in the routing scheme by using spoofed DNS responses and rogue WiFi access points, achieving unencrypted network traffic leak even when a VPN connection is active.
Through extensive testing and experimentation on 66 VPN products and five operating system platforms, the university researchers found that
all of them are vulnerable to TunnelCrack in at least one case. The researchers presented the full details of their discovery in a
technical paper on USENIX Security.