Low level attacks on WLAN/LAN connection while connected to VPN

Question

Is it really secure to connect to a (well-secured) VPN server over an unencrypted WLAN connection (or maybe a hotel Ethernet)?

I know, that there have been questions like this - but

• I'm not asking if people can read/fake the encrypted contents of the VPN connection.
• I'm not asking if the traffic of all my applications will be routed through the VPN.

What I'm worried about are more low level attacks. Is it reasonable to assume (and these are really just a wild guesses) for example,

• that a fake WLAN access point could send specially crafted WLAN packages that would result e.g. in a buffer overflow on my WLAN adapter, which could be used to break into my system?
• that somebody on the same LAN could send low level (ICMP, ARP, ...) packages that could exploit a security vulnerability of the kernel?

Additionally, I'm worried about a possible small time window after the insecure WLAN is established, but before VPN is up and running.

Things like these...

Answer 1

^{Based on your answers, comments, and my general basic understanding of the topic, I'll try to add my own answer here (Note: More answers and comments are very welcome - correct me especially, if my assumptions are wrong.)}

@symcbean puts it in a nutshell:

VPNs only address confidentiality and integrity - not availability.

Availability can either be compromised by disrupting the network: WiFi jamming, flooding the LAN, faking IP or MAC addresses to e.g.

• redirect to a different DNS (which doesn't impact confidentiality/integrity, if the VPN is fully set up, but it can impact availability before it's set up)
• redirect to a different gateway (still doesn't impact confidentiality/integrity, but does impact availability)
• ...

But what's more important: "Availability" of the VPN can be compromised by hacking your laptop on a low level - and many sets of attacks that you're exposed to when you connect to an unprotected network will still work when you tunnel through the unprotected network with VPN. And of course, once you're hacked, availability won't be the only problem...

It's not entirely clear, how likely these attacks are (and this would be a very interesting question!), but the thing that worries me most, is that this topic is never ever mentioned by administrators when they give out VPN access. Generally, an attitude of "it's okay to connect to the most unreliable and dangerous networks in the world - as long as you're using a secure VPN setup, you're safe" has evolved, and it's hard to convince anybody, that security of the VPN is not the only concern!

Answer 2

This is such a weird question. Without trying to address the questions you aren't asking.

Kernel. You are worried about a Kernel Vulnerability? That is highly unlikely but possible if you have an old and vulnerable kernel or if someone drops a 0day on you.

Same LAN attacks Someone on the same LAN could attack you and exploit a security vulnerability in your kernel if you have one. The chances of that happening are also small.

The low level attacks are fear are pretty non-existent. The biggest issue is that you are on a non-secure WLAN. Just being on a non-secure WLAN doesn't mean you are opening yourself up to a whole new set of attacks, but if you have an insecure non-patched computer you would be pretty easy to attack if a hacker connected to the WLAN.

I think you should also read up on your networking stack. ARP is super important and is a trusting protocol but unless there is a 0day it will not let someone remotely execute code on your machine