Why Your VPN May Not Be As Secure As It Claims
Summary: Researchers at Leviathan Security found that abusing DHCP option 121, a feature in the DHCP standard since 2002, lets an attacker on the same local network push routing rules that outrank a VPN's virtual interface, so selected traffic travels over the attacker's gateway unencrypted while the VPN still reports as connected and the kill switch never engages. The technique can be paired with a DHCP starvation attack to force an already-connected VPN to renew its lease, and the researchers say it could be run by anyone who compromises a DHCP server or access point, a malicious network administrator, or an evil twin hotspot.
Why it matters: Bill Woodcock of Packet Clearing House said the attack has been technically possible for 22 years and that he would be surprised if it were not already being exploited against high-value targets, so a traveling executive on a hostile network can have traffic de-cloaked without any alert firing.
Read the original at Krebs on Security ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026