How TunnelVision Can Bypass Your VPN and Break the Internet: Vulnerability Explained

TunnelVision is a new vulnerability that lets any attacker that pretends to be a DHCP server to inject any IP address routes into your computer’s routing table. This potentially lets them redirect traffic so it doesn’t go through your VPN, create a denial of service, or even man-in-the-middle your network traffic.

In this video, you’ll see the attack happen live in action, how it works, and bigger cybersecurity consequences for it besides just turning off some someone’s VPN.

0:00 Introduction to Tunnel Vision Vulnerability
0:16 Demonstration of the attack in a lab environment
1:44 Explanation of the attack scenario
2:20 Effects of the Tunnel Vision attack on VPN protection
3:00 Risks associated with the vulnerability
4:10 Potential impact on critical infrastructure
4:33 Mitigation strategies for VPN users
5:00 Using virtual machines for added security
5:18 Considerations for using mobile hotspots
5:28 Setting up firewall rules to prevent attacks
5:40 Endpoint detection response (EDR) solutions
5:50 Network security monitoring tools
6:12 The importance of understanding networking fundamentals
7:03 Conclusion and invitation for discussion

More Info:

👍 LIKE AND SUBSCRIBE 👏

#TunnelVision #Teleseer #Cyberspatial​ #VPN

Get next-gen PCAP visualization and analysis at:

[lizziemoratti]

One of the authors of TunnelVision here. That was a great video and I wish we had the ability to make those clean animations!

Something to note that this will primarily affect those who are connecting from untrusted networks (i.e. public wifi). Your bottom line explanation was great. Hope you'll do another video when we release the second blog post about the side channel when a provider uses firewall mitigations.

[FBGKaneki-qxdk]

For some reason your videos are easy to understand than other videos 😂

[jasonnaftis]

You can always use a static ip address on devices on your home network.

[glennac]

So, according to the beginning on the video, the attacker has to be on your local network to do this? Or did I misunderstand the beginning? 🤔

[XxguaxinimxX.]

Ok, I'm not gonna lie
I clicked just for the Portal thumbnail 😂😂😂

[dragonsword]

I think the DHCP standard firewall is your best bet, unless the attacker can "convince" the network that it is somehow the home address itself; as per the latter two solutions (endpoint & network security): there's already prints that say the pen can conceal/manipulate the IP such that these security protocols don't recognize it. Speculatively, an industry could somehow how two distinct/autonomous servers, one of which is actually offline and not used for business at all, though somehow make its network configuration such that it is the main/live server, then use it as a honey pot for any pen- although this would presume the pen doesn't know which server is actually live, but some cloud trinkets could buy enough time for the honeypot to activate. Maybe someday DDOS won't be possible if somehow ALL IPs are traceable to its original hardware, but that's more sci fi for now perhaps...