This has been a problem for so long, and everyone just kind of assumes that maybe somebody else fixed it at some other layer. Nobody really thinks about it much. Usually because the poc requires certain preconditions, but they’re not that hard to find.

Not saying it’s nothing, but most of the time I’m using the VPN to access something on a network that’s not publicly accessible, so sending my traffic to the local network won’t do much either.

But if you’re using a VPN to get out of the local network, maybe this is concerning.

Cute attack, though. I like it.