Unpatched iOS bug blocks VPNs from encrypting all traffic

https://www.bleepingcomputer.com/news/security/unpatched-ios-bug-blocks-vpns-from-encrypting-all-traffic/

by notlukesky • 6 years ago

269 85 6 years ago

bitwize• 6 years ago

Maybe Apple is proactively making iOS EARN IT Act compliant?

ronsor• 6 years ago

In case you aren't making a joke, Apple does not have to "EARN" anything as they don't host the VPN service (excluding Apple internal VPNs intended for employees).

eatbitseveryday• 6 years ago

Great, this website bans access from datacenter IP address ranges. In other words, I cannot read this blog while connected to my VPN provider...

Error 1005
The owner of this website (www.bleepingcomputer.com) has banned the autonomous system number (ASN) your IP address is in (xxxxx) from accessing this website.

artificial3• 6 years ago

I suggest the use of Tor.

swsieber• 6 years ago

If they are blocking those addresses, what makes you think they aren't blocking tor?

01CGAT• 6 years ago

Visiting the website through WifiMask VPN (using Digital Ocean servers) works fine.

syntheticcorp• 6 years ago

My self hosted DigitalOcean VPN is blocked by them, I wonder if it’s region specific

unixfg2• 6 years ago

They don't seem to be blocking Linode, maybe they had a problem with that provider.

mirimir8• 6 years ago

They're not blocking IVPN either.

verify_sirrah• 6 years ago

Here is the original report by ProtonVPN.

https://protonvpn.com/blog/apple-ios-vulnerability-disclosur...

taspeotis• 6 years ago

While connections made after connecting to a VPN on your iOS device are not affected by this bug, all previously established connections will remain outside the [VPN]...

Is it a bypass or working by design? If you’re relying on the VPN for security then the fact they were established before it means the horse has already bolted.

nomel2• 6 years ago

Even if it's not by design, is it even possible to move existing connections to another IP address?

Or is the "expected" behavior to sever all connections and let whatever reconnect mechanism work through the VPN?

blattimwind• 6 years ago

Even if it's not by design, is it even possible to move existing connections to another IP address?

Computer Networks 101 Exam

Question 31.) What identifies a TCP connection?

   [ ] Peer IP address
   [ ] Peer IP and Port
   [x] The four-tuple (peer IP, peer port, local IP, local port)

kortilla• 6 years ago

No, you can’t move the TCP connection but a decent expectation would be to interrupt all of the existing TCP connections and let the clients retry and resume the session using a session identifier.

Mobile apps should already be used to IP changes interrupting connections due to WiFi->cellular transitions.

dahfizz2• 6 years ago

The expected behavior is that your OS works correctly.

If a VPN adds a 0.0.0.0/0 route, that route should be respected. Your OS should not circumvent your routing table for some packets and not others.

icehawk2• 6 years ago

This has been standard Mac OS X behavior for a long time: on a machine with multiple IP addresses, connections will use the default gateway associated with the interface providing that address.

monadic27• 6 years ago

Nobody claimed the OS was designed to be secure!

geofft• 6 years ago

https://www.apple.com/ipad/why-ipad/

Giant letters: "It's designed to be secure. And to protect your privacy."

dahfizz2• 6 years ago

As a Linux admin, I am thoroughly confused. Are you saying that MacOS maintains a separate routing table for each interface?

Typically, a system has only one default route. You can have many interfaces and many routes, but only one default. Otherwise you don't know which default gateway to send a packet to.

djrogers• 6 years ago

The GP is wrong, and your understanding is correct - there is one routing table.

monadic27• 6 years ago

We direly need an open source phone as a matter of personal and social security.

jmiserez2• 6 years ago

That won't protect you from bugs. But if you're interested, check out the Librem 5 project.

monadic27• 6 years ago

Actually, having access to the source code does protect you from bugs. Apple ignores all the ones I report.

vbezhenar• 6 years ago

Android is open source operating system. You can use it with some phones.

acd• 6 years ago

There is such a open source phones for example Librem 5 https://puri.sm/products/librem-5/

and Pine phone https://www.pine64.org/pinephone/

ajconway3• 6 years ago

We do, but modern smartphones (if you are not talking about regular phones with no ability to run third-party software) are so complex that it would require a Linux-level _centralized_ effort to pull off. And it's really hard to imagine any centralized effort in this field given the current competition.

monadic27• 6 years ago

I don't see a linux-style effort producing any usable software anyway.

unixfg2• 6 years ago

I've noticed this before with DNS, too. I have internal names that always get resolved externally despite my VPN. Hoping this all gets fixed eventually :(

rsync3• 6 years ago

This is why I use a "slug" when I use a VPN.

A "slug" is a layer-2 bridge, with no IP address configured, that still enforces a TCP/IP whitelist. So it does not "use" a hop on the network route, and you can't see the device, but as it bridges traffic it enforces a (very simple) ruleset.

In my case, I use my own VPN hosts that transact over TCP22 ... and so my network "slug" allows only tcp port 22 traffic. Everything else is blocked.

This means that no matter how badly behaved (or buggy) my VPN software is (I use sshuttle[1]) the bad behavior is blocked by the slug.

The slug itself has almost zero attack surface as it is a BSD based system that has no IP address configured and runs no network services.

I keep meaning to write up a blog entry about this ...

[1] https://sshuttle.readthedocs.io/en/stable/

BeefySwain• 6 years ago

This concept is often referred to as a "VPN killswitch" as well (though that is really a misnomer, IMO).

Popular with pirates because having torrent activity leaked to your ISP is not great.

bitexploder• 6 years ago

I may have a VPN box that only allows traffic to one IP via IP tables/nftables. VPN breaks, no traffic. Simple. It’s useful for more than just piracy though. It’s a nice way to shut down all sorts of ISP crap and guarantee no leakage. Run the household DNS though it as well.

Dylan16807• 6 years ago

I guess you could call it a killswitch, but if so it's a very tiny subset of the ways killswitches are implemented.

zrm2• 6 years ago

Things like this work great for your own network, but you often want a VPN specifically because the network you're connected to isn't yours, especially for iOS (or Android) devices because they're mobile.

zamadatix• 6 years ago

I haven't heard "slug" before, is that your own phrase? It sounds like you've implemented what's known as a stateless transparent firewall if I'm understanding what you've said correctly. Stateless because it's just plain ACLs, transparent because it's not a routed hop/isn't detectable by the client (outside traffic being dropped), and firewall because it's filtering unauthorized traffic. Most people just call it "ACLs" for short though since "stateless transparent firewall" is a bit of a mouthful and "firewall" by itself often implies a routed mode stateful firewall.

rsync3• 6 years ago

"I haven't heard "slug" before, is that your own phrase?"

Yes, although I've been using it for several years when discussing a safety device like this ...

I first discussed a transparent, stateless firewall in 2001 when I wrote a HOWTO for the FreeBSD project:

http://www.kozubik.com/published/freebsd_bridging_ipfw.txt

... although that is hopelessly out of date. Like I said, I keep meaning to do a blog post on this ...

hkiely• 6 years ago

How exactly is this different than how tor works?

rsync3• 6 years ago

It's really not related to Tor, or how Tor works at all ...

However you could use it with Tor in just the same way - your Tor-networked device should be talking on only specific network ports and any other "chatter" should be considered a leak ... so you would configure the "slug" to only allow the Tor-generated traffic on the expected ports.

I do not use Tor and don't have specific ports/protocols information on it ...

mirimir8• 6 years ago

I just use iptables, and allow only output via eth0/enp0s1 to the VPN server, so everything else must use tun0. Or I use pfSense VMs as VPN gateways, with outbound NAT and analogous rules.

But TFA is about iOS, where none of that is possible. Or at least, I'm not aware that it is.

Another thing. Although most people do work with and without VPNs on a given device, that's extremely iffy. Ideally, you want a device to have never hit the Internet directly, but only through the VPN or whatever that you're using. And using pfSense VPN-gateway VMs, that's very easy to do.

bronco21016• 6 years ago

What would be the WiFi equivalent of this? Think a scenario where a road warrior is in need of connecting his or her devices to a public network. It seems my simple OpenVPN setup on each individual device isn’t enough.

Nursie4• 6 years ago

Discovered myself that android has issues.

Start wifi tethering. Connect your VPN, assume traffic is going over it.... nope.

There is a shadow APN configured for your network provider that you can't edit, and all tethered traffic goes over that, not the VPN'd connection.

The VPN only protects traffic originating from the phone.

dylan604• 6 years ago

oooh, that's a nasty thing to find out about. thanks for sharing.

Nursie4• 6 years ago

Yeah, I wondered why, to access services only available over the VPN, I had to run a VPN client on the laptop and on the phone.

Turns out that the phone VPN client only covers phone traffic.

pvtmert• 6 years ago

it was going through vpn in android 4.2 or 4.4 if I'm not mistaken.

But variety of applications can install their cert (with ofc user permission via dialog) and snoop traffic. At least unencrypted.

The way they do it is installing vpn and reading stuff in-between

https://play.google.com/store/apps/details?id=app.greyshirts...

Nursie4• 6 years ago

I believe that you can make a new APN entry, copying the provided settings, without the second tethering-only APN, if you want, which gets around it too.

AFAICT the reason for this second APN is to allow providers to discriminate between phone-originated data and tethering for charging purposes. And they seem to have persuaded google not to allow people to edit it :/

qzio• 6 years ago

Wow, this is pretty... unexpected thanks for sharing.

Nursie4• 6 years ago

Yeah, I consider it a pretty serious security issue.

angott• 6 years ago

https://labs.integrity.pt/articles/the-curious-case-of-apple...

That's a post from April 2019 showing a very similar issue with IKEv2 VPNs leaking traffic on iOS. I wonder if the two issues are related. Back then, Apple was made aware under responsible disclosure but apparently nothing was done about it.

johnklos• 6 years ago

This isn't all that surprising because this is exactly how networking is expected to work. If it is desired to kill all active connections, then it should be explicitly done at the time of VPN connection.

mrunkel• 6 years ago

So, for the folks that consider this a security issue.

Do you really want the OS to break all your existing connections when you start the VPN?

Do you think this is what most people expect to happen?

I would say that the great majority of VPN users use the VPN to gain access to services behind a firewall, not to disguise their location from the world.

I would guess they'd be pretty annoyed to have a file transfer interrupted that has nothing to do with the resources behind the VPN.

Seems bizarre to call this a "bug"

ajconway3• 6 years ago

Do you really want the OS to break all your existing connections when you start the VPN?

Yes, just like when I connect to WiFi while having LTE enabled and active.

Already__Taken• 6 years ago

I have unlimited data, I'd very much rather the device use everything seamlessly

zahma• 6 years ago

I'm not sure if the temporary workaround they propose is a fix or the problem itself. I've noticed when I turn my phone off airplane mode in the mornings, I do not have working VPN connection -- all traffic is blocked. Perhaps this is Wireguard and its particular configuration, or perhaps Wireguard getting a faster start than the operating system reconnecting to my network. In any case, the VPN appears to be blocking traffic. The only workaround I have for that is to disconnect, which takes some time, or switch servers (faster) and reconnect -- and then I guess I'm in the same boat of possible IP leaks.

Unpatched iOS bug blocks VPNs from encrypting all traffic

Related Stories