TunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables
summary
Two novel attacks leak VPN traffic by manipulating the OS routing table: a local-net spoof that advertises public IPs inside the local subnet so clients send target IPs outside the tunnel, and a server-IP attack that spoofs the VPN server IP via plaintext DNS so the client exempts that address. About 200 experiments across Windows, macOS, Linux, Android and iOS show ~2/3 of clients vulnerable somewhere and every VPN fails on at least one OS; demos use rogue Wi‑Fi, DNS spoofing and SSLStrip.
AI-written summary · about
chapters (14)
- 0:00TunnelCrack research intro
- 1:47Why VPNs protect traffic
- 5:21VPN routing table config
- 9:33Local network routing attack
- 14:05Testing VPN clients OS
- 16:38Demo: Traffic interception
- 20:18DNS spoofing variants
- 22:29iOS vulnerability limits
- 25:19Server IP spoofing attack
- 28:52Built-in VPN clients test
- 30:38Demo: Blocking camera traffic
- 33:50Defending against TunnelCrack
- 35:15Conclusion: Design flaws
- 36:00Q&A
related talks
20mBroken Promises: Who's Accountable When VPNs Fail?
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets
29mYou Can’t Hide: How a Device Can Give Away a Fraudster’s Secrets.
43mSecure, Free VPN — Are You Sure?
46mInfiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
48mMobile Security Attacks: A Glimpse from the Trenches
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
41mModding Security & Privacy