83r71nResearchers have discovered a new type of cyberattack called "port shadow" that targets Virtual Private Networks (VPNs). This attack takes advantage of flaws in how VPN servers track internet connections, allowing hackers to secretly spy on users' online activities even though they're supposed to be protected by encryption. The attackers can trick the VPN server into thinking they are someone else, thereby accessing and possibly altering the victim's internet traffic.
The vulnerability lies in the system's ability to keep track of who is connected and what they are doing. By exploiting this, attackers can send fake information that makes the VPN server mix up real users with attackers. This could lead to the interception of sensitive data like passwords and credit card numbers, or even redirecting the user to fake websites designed to steal personal information.
To protect against this, researchers suggest improving how VPN servers isolate processes so that one user cannot interfere with another. This means making sure that each user's connection is handled separately and securely, preventing attackers from being able to manipulate the system.
https://petsymposium.org/popets/2024/popets-2024-0070.pdf
#cybersecurity #vpn #vulnerability #portshadow #server #cyberattack #password #vpnserver
Hostvix