Mullvad VPN: Introducing Defense against AI-guided Traffic Analysis (DAITA)

Technology@lemmy.world – 726 points – 2 months ago

Introducing Defense against AI-guided Traffic Analysis (DAITA) | Mullvad VPN

Even if you have encrypted your traffic with a VPN (or the Tor Network), advanced traffic analysis is a growing threat against your privacy. Therefore, we now introduce DAITA.

Through constant packet sizes, random background traffic and data pattern distortion we are taking the first step in our battle against sophisticated traffic analysis.

You are viewing a single comment

View all comments

How about defense against dhcp option 121 changing the routing table and decloaking all VPN traffic even with your kill switch on? They got a plan for that yet? Just found this today.

https://www.leviathansecurity.com/blog/tunnelvision

https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

I doubt it would matter in some environments at all.

As an example a pc managed by a domain controller that can modify firewall rules and dhcp/dns options via group policy. At that point firewall rules can be modified.

Don't you control your dhcp server?

The Option 121 attack is a concern on networks where you don’t.

Exactly where you’d want a VPN. Cafes, hotels, etc.

True that. Hadn't thought of that as it's not my typical VPN use case.

I'm not sure what a VPN provider could do about that though, they don't control the operating system's networking stack. If the user or an outside process that the user decides to trust (i.e. a dhcp server) adds its own network routes, the OS will follow it and route traffic outside of the tunnel.

The defenses I see against it are:

Run the VPN and everything that needs to go through the VPN in a virtualized, non-bridged environment so it's unaffected by the routing table.
Put a NAT-ing device in between your computer and the network you want to use
Modify the DHCP client so that option 121 is rejected

Edit: thinking about it some more, on Linux at least the VPN client could add some iptables rules that block traffic going through any other interface than the tunnel device (i.e. if it's not through tun0 or wg0, drop it). Network routes can't bypass iptables rules, so that should work. It will have the side effect that the VPN connection will appear not to work if someone is using the option 121 trick though, but at least you would know something funny was happening.

Of course but you don't control rogue dhcp servers some asshat might plug in anywhere else that isn't your network