I contacted Proton VPN about the TunnelVision exploit and I got a response. I feel great about it, thank you Proton!
Hi,
Thank you for your patience.
Our engineers have conducted a thorough analysis of this threat, reconstructed it experimentally, and tested it on Proton VPN. Please note that the attack can only be carried out if the local network itself is compromised.
Regardless, we’re working on a fix for our Linux application that will provide full protection against it, and it’ll be released as soon as possible.
If there’s anything else that I can help you with in the meantime, please feel free to let me know.
Have a nice day!
I’m a bit confused how this is considered a new vulnerability. The IETF RFC which proposes option 121 literally states that malicious DHCP servers could be used to redirect traffic to malicious hosts, and I’m fairly confident that we learned about this exact thing in CCNA school in like 2003 (with regards to router configuration security).
I suppose the application to a VPN attack might be relatively novel?
I think the new thing is that VPN usage is fairly mainstream now. There are lots of services that advertise themselves as having the ability to hide all traffic. It’s certainly news to me, as I hadn’t even heard of a VPN in 2003. The researchers do say that this has been possible since 2002.