Another problematic feature of this attack is that VPNs are often used in locations such as coffee shops, airports, medical facilities, and other locations where WiFi security protections are typically weak or nonexistent.
In a Q-and-A published on a separate Leviathan site, the company noted that while most networks have widespread adoption of DHCP snooping or other protections, “most people using VPNs are not connecting from an enterprise network. They are connecting from public networks or their home networks. In addition, part of the VPN provider threat model is they can secure any untrusted network, including those who do not have these protections.”
Minimizing the risk of TunnelVision
Although there is a no patch or fix for the security hole, there are a few ways to minimize the damage. Companies can ensure all data is encrypted before entering a VPN, which sidesteps the issue as attackers might still be able to learn the data’s destination and who is sending it, but at least the data itself should be protected. In a zero-trust environment, such encryption would be the default choice
