Hacker News new | ask | show | jobs
by this_user 773 days ago
The real problem with all of this is that DHCP has a lot of weird legacy options that most people are not aware off and that may or may not be fully implemented on most clients, but some of which that are pretty powerful. And in practice, clients trust DHCP servers implicitly, because it's an old protocol that didn't really consider the possibility that you may be on a LAN where the DHCP cannot be trusted.
1 comments
agwa 773 days ago
That's not really the problem - DHCP's subnet mask option is definitely not weird or legacy but can also be used to execute these attacks.

The real problem is that encrypted packets from the VPN client use the same routing table as unencrypted packets from applications. This makes it very difficult to create a robust routing policy that says "all unencrypted packets are routed via the VPN, and all encrypted packets are routed via the physical network interface".

link
zokier 772 days ago
> The real problem is that encrypted packets from the VPN client use the same routing table as unencrypted packets from applications

worth noting that this really is very dependent on the specifics of your VPN implementation. For example StrongSwan (ipsec) and WireGuard by default afaik use separate route tables. In general using separate route tables for virtual vs physical networks is not exactly rocket science.

link