Muva nje kwembulwe ukuthi kutholakale indlela evumela umhlaseli ukuthi aphoqe ithrafikhi yomsebenzisi ukuphuma emhubheni wakhe we-VPN esebenzisa izici ezakhelwe ngaphakathi zephrothokholi ye-DHCP.
Le ndlela entsha yokuhlasela ebizwa ngokuthi "i-TunnelVision", ivumela ukuqondisa kabusha ithrafikhi yesisulu nge-host yomhlaseli (uma nje umhlaseli enokufinyelela kunethiwekhi yendawo noma elawula inethiwekhi engenantambo).
Kubalulekile ukuqaphela ukuthi umqondo wokushintsha indlela yokudlulisela idatha endaweni awumusha futhi uvame ukusetshenziswa ekuhlaselweni okuklanyelwe ukukhohlisa amaseva e-DNS. Isibonelo, i-TunnelCrack, eyaqondisa kabusha ithrafikhi ngesango elizenzakalelayo elishintshayo, yathinta wonke amaklayenti e-iOS VPN avivinyiwe, kanye nama-macOS, Windows, Linux, kanye nama-Android VPN.
Mayelana ne-TunnelVision
Kuthiwa ingqikithi ye-TunnelVision ukuthi umhlaseli angaqala iseva yakhe ye-DHCP futhi ayisebenzise ukuthumela ulwazi kuklayenti ukuze ashintshe indlela yokuqondisa . Ngokukhethekile, umhlaseli angasebenzisa inketho ye-DHCP 121, eyenzelwe ukudlulisa ulwazi lomzila oluqhubekayo , ukuguqula ithebula lokuqondisa emshinini wesisulu nokuqondisa ithrafikhi ngaphandle kokudlula ku-VPN.
Injongo yalolu cwaningo bekuwukuhlola le nqubo ngokumelene nabahlinzeki besimanje be-VPN ukuze kutholwe ubungozi babo nokwazisa umphakathi jikelele mayelana nalolu daba. Yingakho sivumelene ne-CISA ukuthi ifake i-CVE uma sibadalula nokuthi kungani sinqume ukusho ubungozi.
Ukuqondisa kabusha kufezwa ngokuhlela uchungechunge lwemizila yama-subnet anesiqalo se-/1 , esibaluleke kakhulu kunomzila ozenzakalelayo onesiqalo se-/0. Ngenxa yalokho, esikhundleni se-virtual network interface elungiselelwe i-VPN, ithrafikhi izoqondiswa nge-interface yenethiwekhi ebonakalayo iye kumphathi womhlaseli kunethiwekhi yendawo.
Esikhundleni sokuthunyelwa nge-VPN, ithrafikhi ithunyelwa ngombhalo ocacile ngaphandle komhubhe ohlelweni lomhlaseli. Le nkinga ithinta noma yiliphi iklayenti le-VPN elingasebenzisi izikhala zamagama zenethiwekhi ezihlukanisiwe ukuhambisa ithrafikhi emhubheni noma elingamisi imithetho yokuhlunga amaphakethe evimbela ukuhambisa ithrafikhi ye-VPN ngokusebenzisa izixhumi zenethiwekhi ezikhona.
I-TunnelVision ingenziwa kunoma yiluphi uhlelo olusekela inketho ye-DHCP 121 , kufaka phakathi i-Linux, i-Windows, i-iOS, ne-macOS, kungakhathaliseki ukuthi iyiphi iphrothokholi ye-VPN esetshenzisiwe (i-Wireguard, i-OpenVPN, i-IPsec) kanye ne-cipher suite esetshenzisiwe.
Kuthiwa i-Android ayinakuthinteka kulokhu kuhlasela ngoba ayicubunguli inketho engu-121 ku-DHCP . Nakuba ukuhlasela kuvumela ukufinyelela kuthrafikhi, akuvumeli ukuvinjelwa kokuxhumeka noma ukunqunywa kokuqukethwe okudluliswa ngamaphrothokholi avikelekile ezingeni lesicelo, njenge-TLS ne-SSH. Isibonelo, umhlaseli akakwazi ukunquma okuqukethwe kwezicelo ezithunyelwe nge-HTTPS, kodwa angaqonda ukuthi izicelo zithunyelwa kuziphi amaseva.
Ukuze kuvikelwe ekuhlaselweni, izinyathelo eziningana zingasetshenziswa ezingeni lokuhlunga amaphakethe: ukuvimbela ukuthunyelwa kwamaphakethe aqondiswe ku-interface ye-VPN ngezinye izixhumi zenethiwekhi, ukuvimba amaphakethe e-DHCP ngenketho 121, ukusebenzisa i-VPN ngaphakathi komshini ohlukile noma isitsha esihlukanisiwe nenethiwekhi yangaphandle, noma ukusebenzisa izindlela ezikhethekile zokucushwa kwemigudu ezisebenzisa izikhala zamagama zenethiwekhi ye-Linux.
Ukuze kusetshenziswe izindlela zobuqili , kuthuthukiswe i-USB dongle eklanywe ngokukhethekile elingisa ukusebenza kwe-adaptha yenethiwekhi futhi, uma ixhunywe kukhompyutha nge-DHCP, izibiza ngokuthi isango. Ngaphezu kwalokho, lapho isango lilawulwa umhlaseli (isibonelo, lapho isisulu sixhuma kunethiwekhi engenantambo elawulwa umhlaseli), kuthuthukiswe inqubo yokufaka amaphakethe emhubheni abhekwa njengavela esibonakalayo senethiwekhi ye-VPN. Kuye kwanyatheliswa nezikripthi eziningana ukuze kuhlolwe lokhu kuhlaselwa.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe ngalokhu , ungathola imininingwane kusixhumanisi esilandelayo.