25
Do we know whether Proton VPN addresses the TunnelVision vulnerability? (lemmy.ml)
submitted 6 months ago by snek_boi@lemmy.ml to c/protonprivacy@lemmy.world
12 comments fedilink hide all child comments

Apparently, the researchers contacted some VPN providers. Perhaps Proton is one of them.

top 12 comments
sorted by: hot top controversial new old
[-] Glass0448@lemmy.today 3 points 6 months ago

Mullvad's response a day after the article. Come on proton, at least a "we saw the article and are looking into it".

https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

Evaluating the impact of TunnelVision

May 7, 2024 Security

We evaluated the impact of the latest TunnelVision attack (CVE-2024-3661) and have found it to be very similar to TunnelCrack LocalNet (CVE-2023-36672 and CVE-2023-35838).

We have determined that from a security and privacy standpoint in relation to the Mullvad VPN app they are virtually identical. Both attacks rely on the attacker being on the same local network as the victim, and in one way or another being able to act as the victim's DHCP server and tell the victim that some public IP range(s) should be routed via the attacker instead of via the VPN tunnel.

The desktop versions (Windows, macOS and Linux) of Mullvad's VPN app have firewall rules in place to block any traffic to public IPs outside the VPN tunnel. These effectively prevent both LocalNet and TunnelVision from allowing the attacker to get hold of plaintext traffic from the victim.

Android is not vulnerable to TunnelVision simply because it does not implement DHCP option 121, as explained in the original article about TunnelVision.

iOS is unfortunately vulnerable to TunnelVision, for the same reason it is vulnerable to LocalNet, as we outlined in our blog post about TunnelCrack. The fix for TunnelVision is probably the same as for LocalNet, but we have not yet been able to integrate and ship that to production.

[-] pathief@lemmy.world 2 points 6 months ago* (last edited 6 months ago)

They have posted on Reddit that if you have kill switch and wireguard you are safe on every platform except Linux. A fix is being worked on for linux, no ETA.

[-] snek_boi@lemmy.ml 3 points 6 months ago* (last edited 6 months ago)

Thanks for the reply! Here's their 2024-5-8 reply for reference:

Hi! Our engineers have conducted a thorough analysis of this threat, reconstructed it experimentally, and tested it on Proton VPN. We concluded that:

  • the attack can only be carried out if the local network itself is compromised
  • our Windows and Android apps are fully protected against it
  • for iOS and macOS apps, you are completely protected from this as long as you're using a Kill Switch and a WireGuard-based protocol (our apps use WireGuard by default, and if a user wants to use something other than WireGuard derivates, they'd have to manually set it up). Note that Stealth, WireGuard TCP, and our Smart protocol on iOS/macOS are all WireGuard-based.
  • for our Linux app, we're working on a fix that would provide full protection against it.
[-] originalucifer@moist.catsweat.com -5 points 6 months ago

its about the client.

im using linux so im not affected using proton.

[-] NeatNit@discuss.tchncs.de 6 points 6 months ago

Linux is affected.

[-] originalucifer@moist.catsweat.com 3 points 6 months ago

source?

[-] NeatNit@discuss.tchncs.de 11 points 6 months ago

https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/

Interestingly, Android is the only operating system that fully immunizes VPN apps from the attack because it doesn't implement option 121. For all other OSes, there are no complete fixes. When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks.

I did not look into that setting that minimises the effect but from the way it's written it sounds like this isn't used by default, so by default you're still vulnerable. Add even if it's on, there's still a side vulnerability.

[-] originalucifer@moist.catsweat.com 3 points 6 months ago* (last edited 6 months ago)

well, im not as im not using interfaces that are affected by the vulnerability (im using named, containerized network interfaces), but i appreciate the info!

it was initially reported as 'linux & android' were not affected.

i stand by my statement that this isnt about the VPN provider, its a client problem. so the question about Proton is moot.

[-] NeatNit@discuss.tchncs.de 3 points 6 months ago* (last edited 6 months ago)

I think by client you mean the device and operating system, which is correct to my understanding, but it's confusing because 'client' can also mean the VPN client software which is often supplied by the VPN provider, and that's what I first think when you say client. So with that in mind it sounds like you're saying "it's not about the VPN but the VPN software" which obviously comes from the same provider.

I have not looked into it so you probably understand this more than I, but from the sound of it the VPN software can be built to detect, prevent or counteract the exploit even on affected systems? In which case, even though it's an environment issue it can still be resolved by the VPN provider.

[-] originalucifer@moist.catsweat.com 2 points 6 months ago

youre correct. its the local routing table that is vulnerable, which is usually handled by the OS.

I had not yet heard of any mitigation techniques from the vpn provider side. glad to know they are assisting with this OS/client failure.

[-] NeatNit@discuss.tchncs.de 3 points 6 months ago

I have no idea if they are assisting, it's all baseless conjecture on my part! Sorry if that wasn't clear, I thought it was

[-] Glass0448@lemmy.today 1 points 6 months ago

Mullvad already published a blog post a day after stating they reviewed the vulnerability, and it was closed up during their process of fixing a different vulnerability. https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

That we haven't heard anything from proton regarding this vulnerability is not a good sign. Article came out on May 6th and proton has only published basic privacy guides.

this post was submitted on 07 May 2024
25 points (96.3% liked)

Proton

5262 readers
12 users here now

Empowering you to choose a better internet where privacy is the default. Protect yourself online with Proton Mail, Proton VPN, Proton Calendar, Proton Drive. Proton Pass and SimpleLogin.

Proton Mail is the world's largest secure email provider. Swiss, end-to-end encrypted, private, and free.

Proton VPN is the world’s only open-source, publicly audited, unlimited and free VPN. Swiss-based, no-ads, and no-logs.

Proton Calendar is the world's first end-to-end encrypted calendar that allows you to keep your life private.

Proton Drive is a free end-to-end encrypted cloud storage that allows you to securely backup and share your files. It's open source, publicly audited, and Swiss-based.

Proton Pass Proton Pass is a free and open-source password manager which brings a higher level of security with rigorous end-to-end encryption of all data (including usernames, URLs, notes, and more) and email alias support.

SimpleLogin lets you send and receive emails anonymously via easily-generated unique email aliases.

founded 1 year ago
MODERATORS
ProtonPrivacy@lemmy.world
alex_herrero@lemmy.world
Nelizea@lemmy.world