New Android leak lets any app bypass VPN and expose your real IP
Another way to leak traffic on Android has been discovered
A newly discovered flaw in Android's network stack allows any app to send UDP packets outside the VPN tunnel, even when 'Block all connections without VPN' is enabled. The attack abuses a hardware-offloaded keep-alive connection meant for NAT traversal, requiring no special permissions. The researcher reported it to Google's Android VRP, but the issue was closed without action. GrapheneOS is working on a fix; Mullvad says a theoretical mitigation isn't reliable.
The malicious app does not need any special permission to perform this attack.
- brinepot
'Closed without action' is the tell. A leak that Google knows about and leaves in place isn't a bug anymore, it's a feature they're comfortable with.
- codedokode
The stupid thing about Android is that it requires you to set a PIN to use Always-on VPN which is necessary for traffic filtering (as Android doesn't provide access to nft).
- exceptione
> A proper fix would require changes in the Android system. The researcher who discovered the leak has reported the issue to the Android Vulnerability Reward Program, but according to the researcher the issue was closed without action. This issue is not public, but based on this information we deem it unlikely that Google will do anything about it. GrapheneOS is aware of the issue and are working on a fix.
If the account given by the researcher is correct, we cannot rule out that Google deliberately introduced or wanted to keep the leak in place.
- exceptione
This paper goes into much more detail: https://supuk.ch/papers/android-natt-keepalive-vpn-bypass
- nonamesleft
As a quick kludge use an USB-C wlan network adapter that lacks the functionality for this type of connection (albeit that won't help you with a cellular connection)?