iOS 16 VPN Tunnels Leak Data, Even When Lockdown Mode Is Enabled

[Shirasaki]

I don’t know anything about modern software design … but is this a hard problem to solve in iOS or is apple just being slow (or both)?

There must be political reasons behind the seeming negligence. For example, not fixing the "bug" so they can still sell their iPhone iPad etc in China.
There's no way this issue being present for years and they somehow are not aware of it at all.
Or Apple is slowly killing VPN effectiveness to boost their service revenue? Ads revenue?
Or Apple is pressured by big labels etc to increase the difficulty of geo-restriction bypass?
So many possible reasons, yet Apple will confirm none of them.

 

[mystery hill]

This is the most troubling part! Apple has the resources to fix anything they want to fix, why haven't they fixed this?

Tim Cook will be like: "I don't hear our users asking that we put a lot of energy in on that at this point."

 

[dk001]

And they are going to have to fix it for ios 15 as well

It has been around for a few years now.
Hoping Apple fixes it but not holding my breath.

 

[huges84]

It is utterly inexcusable that Apple has let this flaw exist for 3 years. Even if they weren’t pushing their privacy focused marketing it would be terrible. But given that marketing, it’s abhorrent! Get your **** together Apple

 

[huges84]

How do you know? Do you have the source code?

Not sure what you’re trying to say. The kernel is open source. Google services stuff is not. But having source code guarantees nothing about security.

 

[anshuvorty]

So, the reason this bug hasn’t been fixed yet is because all engineers are currently during their best to salvage Stage Manager.

It’s “all hands on deck” right now for Stage Manager and all other bugs be damned…

I’m sure Apple will get around to this bug, possibly, by iOS 20…

 

[Danfango]

what does the P stand for again?

Profit?

 

[dk001]

There must be political reasons behind the seeming negligence. For example, not fixing the "bug" so they can still sell their iPhone iPad etc in China.
There's no way this issue being present for years and they somehow are not aware of it at all.
Or Apple is slowly killing VPN effectiveness to boost their service revenue? Ads revenue?
Or Apple is pressured by big labels etc to increase the difficulty of geo-restriction bypass?
So many possible reasons, yet Apple will confirm none of them.

This came up during the ProtonVPN testing by Proton AG back in 2020.

VPN bypass vulnerability in Apple iOS | Proton VPN

We discovered a security vulnerability in Apple’s iOS that causes connections to remain unencrypted even after connecting to VPN.

protonvpn.com

iPhone VPN app security debate continues – is it fixed or not?

Update: AmpliFi, which offers routers with built-in VPN capabilities, backs Proton’s position that the fix doesn’t reliably work – see...

9to5mac.com

 

[BGPL]

VPNs aren't bulletproof, but these are negligent oversights. I'm guessing Apple doesn't want to make the. necessary changes to iOS that may adversely affect the user experience, such as killing all existing sessions (which could result in the user being challenged for credentials repeatedly). The truth is, Apple is more concerned with the appearance of privacy rather than actually protecting its customers.

 

[BGPL]

vpn is no privacy tool, it is for connecting 2 networks secure. Don't try to change a feature to do a thing it is not meant to do...

This is 100% true. Back in the day I had an ssh VPN to my house from work so I could use the Internet without being monitored or filtered. The company blocked the most ridiculous and benign content. This exact function morphed into what we have today.

 

[TroyBoy30]

#security

 

[JoEw]

Let’s get real Apple doesn’t close this security hole because the NSA harvests this data from Apple. Those who think Apple is some kind of privacy warrior clearly doesn’t remember the Snowden leaks that showed Apple participating in PRISM. With a gag order.

 

[Mr. Dee]

I am beginning to think a lot of Apples privacy and security advertising is just smoke and mirrors. Its only a matter of time until hackers reveal the flaws and its gonna be damaging. Lets hope Apple is hiring the best to stay ahead of these holes and vulnerabilities.

 

[IIGS User]

Going old school for the sake of security.

Hey's it's 14.4K with forward error correction!

Yes, I had one of these....

 

[Pezimak]

That’s disgraceful, who knows what data Apple devices are sending back, outside the VPN! And then it continues to ‘leak’ data. This is a security hole Apple should be swallowing its price on and fixing.

I was using my VPN when at work on the unsecured free WiFi, I’ll stick to my cellular data in future as it’s much more secure seemingly.

 

[basehead617]

I could not care less about this

 

[bankshot]

This is the most troubling part! Apple has the resources to fix anything they want to fix, why haven't they fixed this?

Every time something like this comes up, I think of this blog post from a former Apple engineer:

Regressions Get Fixed. Old Bugs Get Ignored.​

Apple is lousy at fixing old bugs.

Apple pays special attention to new products like the iPhone 11, looking for serious customer problems. It jumps on them quickly and generally does a good job of eradicating major issues. But any bugs that are minor or unusual enough to survive this early scrutiny may persist forever.

Remember what I said about changes causing new bugs? If an engineer accidentally breaks a working feature, that’s called a regression. They’re expected to fix it.

But if you file a bug report, and the QA engineer determines that bug also exists in previous releases of the software, it’s marked “not a regression.” By definition, it’s not a new bug, it’s an old bug. Chances are, no one will ever be assigned to fix it.

Not all groups at Apple work this way, but many do. It drove me crazy. One group I knew at Apple even made “Not a Regression” T-shirts. If a bug isn’t a regression, they don’t have to fix it. That’s why the iCloud photo upload bug and the contact syncing bug I mentioned above may never be fixed.

I have no idea how widespread this attitude may be inside Apple, or if the culture has shifted away from it in the last few years. But as a consumer on the outside, it does seem like issues often get ignored for years like this unless some executive decides it's a priority. It's incredibly frustrating as a user when one of these things affects you directly, and there's simply no way to give feedback to someone who actually has the power to do something about it.

 

[vegetassj4]

Come on. Apple always has to make things thinner, so they went from VPN to VN to get rid of some of the (P)ork.

Actually quite troubling. I use Wireguard on any network outside of my house to VPN back for more security. Looks like it is not as secure as I thought.

 

[Populus]

Thank you @Hartley and Thank you MacRumors for pushing this to the front page. You can give it more visibility than us!

I think it is a shame this keeps happening on a platform that sells privacy as one of their key features.

 

[Pezimak]

This is really bad. It’s one thing to have gaps in your privacy, but it’s something else entirely to have a user believe that their Virtual Private Network is, well, Private and unknowingly be leaking data. If I were a person who’s privacy was important, such as a journalist or activist, this would chill me to the bone. As someone who thinks protecting those people is a priority, this just makes me very angry.

if you were one of those people, shockingly you’d be better off with an android phone and a VPN!

 

[Babygotfont]

Pegasus’ Revenge

 

[bmark]

This Apple VPN Tunnel leak is on purpose so there is no privacy at all! Big brother is watching everything on your Apple devices.

 

[Populus]

**** Apple. There's a damn difference between real privacy and security and real good privacy and security marketing.

I couldn’t have said it better.

 

[now i see it]

But lockdown mode makes me feel good

 

[t0rqx]

I do not understand how oblivious people are. This is the USA way on spying people. Apple wants to fix this, but this is a backdoor for the government.