Technology

60080 readers

3878 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

737

Mullvad VPN: Introducing Defense against AI-guided Traffic Analysis (DAITA) (mullvad.net)

submitted 7 months ago by [email protected] to c/[email protected]

178 comments fedilink hide all child comments

Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.

Through constant packet sizes, random background traffic and data pattern distortion we are taking the first step in our battle against sophisticated traffic analysis.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 27 points 7 months ago (2 children)

How about defense against dhcp option 121 changing the routing table and decloaking all VPN traffic even with your kill switch on? They got a plan for that yet? Just found this today.

https://www.leviathansecurity.com/blog/tunnelvision

[–] [email protected] 45 points 7 months ago (1 children)

https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

[–] [email protected] 2 points 7 months ago

I doubt it would matter in some environments at all.

As an example a pc managed by a domain controller that can modify firewall rules and dhcp/dns options via group policy. At that point firewall rules can be modified.

[–] [email protected] 13 points 7 months ago (2 children)

Don't you control your dhcp server?

[–] [email protected] 17 points 7 months ago (1 children)

The Option 121 attack is a concern on networks where you don’t.

Exactly where you’d want a VPN. Cafes, hotels, etc.

[–] [email protected] 5 points 7 months ago* (last edited 7 months ago)

True that. Hadn't thought of that as it's not my typical VPN use case.

I'm not sure what a VPN provider could do about that though, they don't control the operating system's networking stack. If the user or an outside process that the user decides to trust (i.e. a dhcp server) adds its own network routes, the OS will follow it and route traffic outside of the tunnel.

The defenses I see against it are:

Run the VPN and everything that needs to go through the VPN in a virtualized, non-bridged environment so it's unaffected by the routing table.
Put a NAT-ing device in between your computer and the network you want to use
Modify the DHCP client so that option 121 is rejected

Edit: thinking about it some more, on Linux at least the VPN client could add some iptables rules that block traffic going through any other interface than the tunnel device (i.e. if it's not through tun0 or wg0, drop it). Network routes can't bypass iptables rules, so that should work. It will have the side effect that the VPN connection will appear not to work if someone is using the option 121 trick though, but at least you would know something funny was happening.

[–] [email protected] 3 points 7 months ago

Of course but you don't control rogue dhcp servers some asshat might plug in anywhere else that isn't your network