Android devices with a VPN intentionally leak some traffic, including IP addresses and DNS/HTTP(S) requests, when connected to a wireless network. According to the security audit conducted by Mullvad VPN, the leak of a small amount of data is rooted in the mobile operating system, which is something that third-party VPNs cannot prevent or control.
The Europe-based VPN service provider said this enablement Always on VPN And the Block connections without a VPN Does not help either. Mullvad VPN noticed that the bug (Google says it’s a feature) is built into Android.
A Google engineer told Mullvad VPN on the search giant’s website Problem Tracking Page. “We don’t think such an option would be understood by most users, so we don’t think there is a strong case for making that.”
Let’s see how VPNs work on Android.
When an Android device connects to a public network, it performs certain checks before a connection is successfully established. To perform these checks, Mullvad VPN has detected that Android sends data outside the secure tunnel that protects users from the Internet.
Block connections without a VPN It is an Android setting designed to prevent this, which may happen during connection checks. Google noted that split tunneling can also cause a portion of the traffic to be leaked across the underlying network.
“We understand why Android would want to send these visits by default. If for example there is a restricted portal [a webpage usually displayed after a device connects to a new public network] On the network, the connection will be unusable until the user logs into it, “Mullvad VPN Wrote.
See more: Built-in VPNs for iOS have been leaking traffic data for over 2 years
“So most users want to perform a restricted portal scan and allow them to view and use the portal. However, this can be a privacy concern for some users with certain threat models,” the company added.
In fact, since the small amount of data that the operating system leaks includes DNS and HTTP(S) lookups and possibly NTP traffic and a user’s IP address (as metadata), this is exactly what users intend to protect by taking advantage of VPNs.
The problem is deeper. VPNs on Android leak traffic data even on well-known networks where there is no captive gateway and no connection check is required. That’s why Mullvad VPN suggested that Google disable connection checking by default and give users the option to do it when they feel necessary, a similar function in the privacy and security-focused iteration of Android, GrapheneOS.
Additionally, Mullvad VPN has indicated that split tunneling is an optional feature that should not require traffic data leakage, no matter how small.
Connection scan traffic can be observed and analyzed by the controlling party of the connection scan server and any entity that monitors network traffic. Even if the message content does not reveal anything more than “some connected Android devices”, metadata (which includes the source IP address) can be used ) to derive more information, especially if combined with data such as the locations of WiFi access points,” Mullvad VPN added.
The company also indicated that the metadata being leaked must be anonymised, which requires a certain degree of complexity on the part of the threat actor.
Google explained that the data in question is available anyway through the L2 connection. “Even if you’re okay with some of the traffic exiting the VPN tunnel, we think the name of the setting (“block connections without VPN”) and Android’s documentation about it is misleading,” Mullvad VPN said. “The impression the user gets is that no phone traffic will leave except through the VPN.”
Image source: shutterstock
More about security and privacy
#Android #design #leaks #VPN #traffic #data #Google #calls #intended #behaviour