It gets worse in the case of Apple’s push notifications, as those connections can remain open for hours, not minutes. This is a big deal because existing insecure connections can last for several minutes at a time, meaning that if you switch on your VPN in order to do something confidential, the first things you do may not be protected. The latest version of iOS that I tested with is 15.6. I confirmed this using multiple types of VPN and software from multiple VPN providers. This is not a classic/legacy DNS leak, it is a data leak. Data leaves the iOS device outside of the VPN tunnel. But, over time, a detailed inspection of data leaving the iOS device shows that the VPN tunnel leaks. The iOS device gets a new public IP address and new DNS servers. The problem, says Horowitz, is that iOS doesn’t allow VPN apps to close all existing non-secure connections. Why iOS VPN apps are brokenĪs soon as you activate a VPN app, it should immediately close down all existing (non-secure) data connections, and then reopen them inside the secure “tunnel.” This is an absolutely standard feature of any VPN service.
Similarly, the websites and servers you are accessing don’t get access to your IP address, location, or other identifying data – your traffic appears instead to be originating from the VPN server. The usual analogy is it’s like using a secret tunnel from your device to the VPN server. All they can see is that you are using a VPN. Your data is protected from an ISP, carrier, or hotspot operator.
This is easy to do, and can be as simple as plugging a power-brick-size device into a coffee shop power outlet.Ī VPN instead sends your data in encrypted form to a secure server. This is when a bad actor creates a Wi-Fi hotspot that mimics a genuine one, but which routes all traffic through their system first, letting them log all of your data. When using public Wi-Fi hotspots, you’re also at risk from what are known as man-in-the-middle (MITM) attacks. That means that your ISP can see who you are and which sites and services you are accessing. They then forward it to the remote server. Normally, when you connect to a website or other server, your data is first sent to your ISP or mobile data carrier. His blog post about the issue is titled “ VPNs on iOS are a scam.” How VPNs (are supposed to) work Michael Horowitz’s actual words are a little blunter than our headline. This backs a previous report by ProtonVPN that a VPN vulnerability has been present on iOS devices since at least iOS 13.3.1, and that there is no 100% reliable way of ensuring that your data is being sent via the VPN … Update: Apple does appear to have introduced an (optional) fix for this as of iOS 14, but questions remain – see update at end.Ī well-known security researcher says that iOS VPN apps (virtual private networks) are broken, due to a flaw that he claims Apple has known about for at least two and a half years.
0 kommentar(er)
