TunnelVision Vulnerability 

13.05.24

Threat Intelligence Alerts

TunnelVision is a new security vulnerability that affects VPN applications. It allows attackers to steal data that should be encrypted by the VPN. The vulnerability exists because of a setting called DHCP option 121, which can be used to manipulate routing rules. This diverts traffic away from the VPN’s encrypted tunnel. 

Attackers can exploit the TunnelVision vulnerability by setting up a rogue DHCP server on the same network as the victim. The rogue DHCP server will then send a message to the victim’s device, telling it to use the rogue server for DNS resolution. Once the victim’s device is using the rogue server, the attacker can intercept and decrypt all of the victim’s traffic. 

The TunnelVision vulnerability is a serious security risk. It can be used to steal sensitive data, such as credit card numbers, passwords, and personal information. It can also be used to spy on victims’ communications and track their online activity. 

There are a few things you can do to protect yourself from the TunnelVision vulnerability: 

If you think you may have been a victim of the TunnelVision vulnerability, you should take the following steps: 

TunnelVision: How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak 

Novel attack against virtually all VPN apps neuters their entire purpose