VPNs for iOS Are Broken and Apple Knows It, Says Security Researcher

[bobcomer]

Most DoS countermeasures are of the form of rate limiting. E.g. less than X per second. This is the other way around, as it affect only one. Hard to detect a pattern. Don’t think it’s that easy to stop bad actors. Once the pandora box is opened …

Well, if you have a malware app on your phone, you're owned anyway, even if it's a VPN.

In any case, I know my VPN vendors and it's not a concern for me...

 

[quarkysg]

Well, if you have a malware app on your phone, you're owned anyway, even if it's a VPN.

In any case, I know my VPN vendors and it's not a concern for me...

So you agree with me then?

 

[dk001]

Finally, someone mentions battery life. I can't be the only one who usually avoids VPN on my mobile device because of battery life concerns. 99.99% of my VPN usage is on my work laptop or personal laptop if I'm on a wifi that is not what I consider to be "safe" - like airports, coffee shops, work conferences, colleges, etc.

My mobile device? Almost always I have cellular and instead of VPN, I'll hotspot to my phone (my preference). I've only really used VPN on my mobile device when out of the country and on wifi that I didn't "trust" that I wanted to be a little more secure with. But I found VPN through my mobile device: 1. Drained the battery like crazy. 2. Usually resulted in telephone line like speeds. 3. Almost unusable internet (in XYZ country).

Free or Paid VPN?
I use paid and I'm not seeing this on either iOS or Android.
Then again, I use as needed and not 100%...

 

[BigMcGuire]

Free or Paid VPN?
I use paid and I'm not seeing this on either iOS or Android.
Then again, I use as needed and not 100%...

Only paid (I don't trust free VPNs) - I've used NordVPN for the last handful of years. Last time I heavily used VPNs on my iPhone was around 2018 for work trips and I noticed heavy/very noticeable drain on my iPhone. So my info is a bit out of date. Ugh, I'm getting old.

Same - I use as needed instead of leaving it on all the time now and it's barely noticeable when I do that .

 

[Artemis70]

Neither Horowitz, Proton, any of the publications echo-chambering this story, or even Apple PR themselves, seem to be able to elucidate this issue coherently.

Here’s a write-up from the folks at Disconnect.me;
https://blog.disconnect.me/ios-vpn-leak-advisory/

It’s Apple fault, and if that write-up is anything to go by, it’s a bigger problem than many realize.

Thank you. That is written so much better and provides so much more background!

 

[bobcomer]

Ugh, I'm getting old.

Me too, but that's a good thing, it means we're still alive.

 

[bobcomer]

So you agree with me then?

No. I would consider it a bug in the OS if it didn't handle that scenario. And I would also think that Apple would figure out what it did and not allow it in the app store.

 

[chucker23n1]

VPN apps are supposed to be trusted then?

A VPN app (and/or the company running the VPN server) requires a higher level of trust: trust that the app encrypts your uploaded data and does nothing else, and trust that the server forwards the data after decrypting and does nothing else.

So, yes, you're gonna have to trust it. If you don't, you can't use that app.

I don’t think it’s as simple as you make it out to be. I don‘t think giving an app to control network connection is a good idea. I fiddle with Linux netfilter as a hobby. It’s not as simple as one think it is.

Then you trust netfilter.

 

[russell_314]

Well, as a corporate guy I can tell you why I use a VPN. It's to mainly protect the corporate goodies, i.e., to not allow direct access to our servers from the internet. Every second of every day there are the script kiddies scanning everything they can scan, and the traffic is tremendous, almost a DoS type thing. I'm not that worried about them getting in, but I really don't even want them to see anything to keep them from the constant attempts.

It also protects the other side somewhat from TCP them having sensitive information just grabbed from whatever LAN they are on.

So it's more of a protection thing than a privacy thing. (and I control the VPN servers, so I don't have to worry about trusting a third party.

That’s a different use of a VPN than what most people think when you say VPN. You’re talking about VPN into to a corporate network. I have this on one of my work devices. Yes that definitely does have advantages in the corporate world but most people think of a VPN is the ones advertised as a subscription. If you’re really security conscious you can do the same thing they do in the corporate world and VPN to your home network but most people aren’t going to do that.

 

[russell_314]

It also makes one realise that the average consumer really has no way of verifying just how well a VPN works on any device. We are just supposed to trust them (and the random tech YouTubers) that it will protect our privacy on untrusted networks.

Most people don’t even understand the concept of a VPN much less if it’s working. They just see their favorite YouTube celeb selling it and think oh I need that. I had a family member tell me they got a VPN subscription. I asked why. They said oh it makes the Internet more secure so they can’t be tracked online. Yeah no not even close. What upsets me is I’ve seen some of the ads and they’re highly misleading. I think most of these companies are outside the US, UK and EU so they’re probably protected from any kind of false advertising litigation. If you’re someone who uses a VPN just because you don’t want to be tracked by your ISP you might want to look at who owns most of these VPN services. You might as well sign up for Facebook or Google VPN if there was such a thing 😂

 

[bobcomer]

That’s a different use of a VPN than what most people think when you say VPN.

True, but it's still a VPN and it works in the same way.

You’re talking about VPN into to a corporate network. I have this on one of my work devices. Yes that definitely does have advantages in the corporate world but most people think of a VPN is the ones advertised as a subscription. If you’re really security conscious you can do the same thing they do in the corporate world and VPN to your home network but most people aren’t going to do that.

Most people wouldn't know how, but it's certainly doable. I don't most of the time, and I've only rarely used the consumer VPN's. I'm not that worried about my internet access though and I've never tried to obfuscate my location.

 

[dwaite]

iOS doesn't implement a lot of VPN protocols, so it's good that they've eventually (ca. iOS 9?) allowed third parties to fill in the void.

Just VPN, L2TP, PPTP, IPSec, and IKEv2, with support for passwords, certificates and Cisco's proprietary XAuth authentication.

Also, PPTP supports (horrible) encryption but is not a standard - it is a Microsoft invention.

Yes, but OpenVPN itself isn't actually included in iOS. If you use an entirely open-source, non-proprietary OpenVPN solution, you still need an app in iOS to actually use it, because iOS does not ship that protocol at all.

OpenVPN uses their own proprietary security protocol based on TLS, rather than supporting standards (such as L2TP, IPSec or IKEv2).

Get OpenVPN to create a standard and commit to supporting it in a stable manner and I bet you'd see support in a lot of operating systems pretty quickly.

 

[dwaite]

If:

• without the VPN, a route to IP address 1.2.3.4 gets handled through the ISP,
• with the VPN, the route gets replaced by one handled by the VPN server,
• a connection exists before connecting to the VPN,
• after connecting, that connection continues to exist, with the now-outdated route,

then that's at least a problematic behavior, if not outright a bug.

1.2.3.4 is not a private network.

VPN is a protocol to connect to private networks.

You are asking for iOS to treat all public internet resources (other than, presumably, the VPN server) as private network resources.

 

[chucker23n1]

Just VPN, L2TP, PPTP, IPSec, and IKEv2,

First… "VPN"??

Second, iOS supports L2TP and IKE. It also supports "IPSec", by which it means Cisco's VPN, which is IKE.

with support for passwords, certificates and Cisco's proprietary XAuth authentication.

Also, PPTP supports (horrible) encryption but is not a standard - it is a Microsoft invention.

Did you just change your goalpost from "MOST standardized VPN protocols do not define encryption" to "sure, I can't name a single example of a VPN that doesn't define encryption, but I can name one whose two-decades-old encryption is poor by modern standards"? Impressive!

OpenVPN uses their own proprietary security protocol based on TLS, rather than supporting standards (such as L2TP, IPSec or IKEv2).

I have no idea why that's relevant, but yes.

Get OpenVPN to create a standard and commit to supporting it in a stable manner and I bet you'd see support in a lot of operating systems pretty quickly.

OpenVPN is plenty good the way it is.

1.2.3.4 is not a private network.

This isn't relevant.

First of all, "private network" only refers to get to assign IP addresses. And even then, nothing stops you from simply setting your own host to 1.2.3.4. You lose the ability to reach the "official" machine with that IP address, but that's all.

Second, while VPNs are often used to connect to private networks, they don't have to do that at all. A VPN for Apple employees will route you to the 17.* range, which isn't private at all.

And plenty of VPNs these days have nothing to do with specific routes and everything to do with tunneling all transferred data over a VPN server, whether it be for privacy reasons, or to pretend-change your physical location, or simply because your employer wants to control what data you transfer over your employer-issued device.

VPN is a protocol to connect to private networks.

"VPN" is not a protocol, and VPNs have been used for other use cases than that basically since their inception a quarter century ago.

You are asking for iOS to treat all public internet resources (other than, presumably, the VPN server) as private network resources.

First, "private network resources" aren't really a thing. And second, iOS can do exactly that and has been doing that ever since it has supported VPNs in iPhoneOS 2.0.

 

[MAlbi]

At last an article worth reading! Thank you for this. More, more !!!

 

[dwaite]

First… "VPN"??

Second, iOS supports L2TP and IKE. It also supports "IPSec", by which it means Cisco's VPN, which is IKE.

Sorry, paste error. “VPN” = app supplied.

Did you just change your goalpost from "MOST standardized VPN protocols do not define encryption" to "sure, I can't name a single example of a VPN that doesn't define encryption, but I can name one whose two-decades-old encryption is poor by modern standards"? Impressive!

You said PPTP. PPTP is not a standard.

First of all, "private network" only refers to get to assign IP addresses. And even then, nothing stops you from simply setting your own host to 1.2.3.4. You lose the ability to reach the "official" machine with that IP address, but that's all.

Assigning addresses and routes to publicly assigned 3rd party addresses as part of your own network is widely discouraged.

Private address ranges include 10.x.x.x and 192.168.x.x.

Second, while VPNs are often used to connect to private networks, they don't have to do that at all. A VPN for Apple employees will route you to the 17.* range, which isn't private at all.

You can have addresses you control as part of your private network, sure. It is discouraged to have these be public as well.

And plenty of VPNs these days have nothing to do with specific routes and everything to do with tunneling all transferred data over a VPN server, whether it be for privacy reasons, or to pretend-change your physical location, or simply because your employer wants to control what data you transfer over your employer-issued device.

There are privacy reasons not to support that. An employer with a private network should not be able to capture public internet traffic for a device you own, without your approval.

Apple has banned apps which do this, such as Facebook and Google apps (which were deployed with enterprise profiles to work around limitations) and many earlier parental monitoring apps.

VPN apps which self configure (e.g. without the use of enterprise profiles) have several documented limitations. The idea of enterprise profiles is that you have a strong relationship with that party and can hold them liable for abuses.

"VPN" is not a protocol, and VPNs have been used for other use cases than that basically since their inception a quarter century ago.

I also received a book decades ago called “101 uses for a dead cat”. Theoretical application of VPN technology does not make it a supported platform feature.

First, "private network resources" aren't really a thing. And second, iOS can do exactly that and has been doing that ever since it has supported VPNs in iPhoneOS 2.0.

Apple has changed VPN capabilities several times since then, including adding application provided vpn functionality, including banning certain uses.

Please accept the possibility that changes are intentional.

 

[chucker23n1]

Assigning addresses and routes to publicly assigned 3rd party addresses as part of your own network is widely discouraged.

I'll keep that in mind the next time you're my supervisor.

Private address ranges include 10.x.x.x and 192.168.x.x.

And 172.16/12. And still completely irrelevant.

You can have addresses you control as part of your private network, sure. It is discouraged to have these be public as well.

By whom? And why? Are you implying Apple's security practices are bad?

There are privacy reasons not to support that. An employer with a private network should not be able to capture public internet traffic for a device you own, without your approval.

That's a fine argument, but Apple is letting VPNs do exactly that, so it's not an argument relevant to this thread.

Apple has banned apps which do this, such as Facebook and Google apps (which were deployed with enterprise profiles to work around limitations) and many earlier parental monitoring apps.

That's not why those apps were banned.

There's also nothing to ban. Step 1: make a VPN config that routes all traffic. Step 2: deploy it via MDM.

Apple has changed VPN capabilities several times since then, including adding application provided vpn functionality, including banning certain uses.

Please accept the possibility that changes are intentional.

So your argument is now: Apple won't fix this, and in fact, Apple will remove the ability of VPNs to route all traffic altogether.

I see.

 

[dwaite]

I'll keep that in mind the next time you're my supervisor.

Eh, I forfeit this argument. 🤷‍♂️

 

[quarkysg]

A VPN app (and/or the company running the VPN server) requires a higher level of trust: trust that the app encrypts your uploaded data and does nothing else, and trust that the server forwards the data after decrypting and does nothing else.

So, yes, you're gonna have to trust it. If you don't, you can't use that app.

Not really. This will be dangerous to just trust one category of apps. Nothing stops a bad actor from creating an app pretending to be a VPN app.

IMHO the security model for a mobile device is very much different from a desktop computer. For a computer model, you trust the login account and assign the rights to the apps running under that accounts rights (e.g. root, users, etc.)

For a mobile devices, since there's no concept of user account, the model is basically to restrict apps' ability to do stuffs.

Then you trust netfilter.

Seems like you don't know what is the Linux netfilter sub-system. I would say that it basically powers the Internet infrastructure. I can change the behaviour of how netfilter works as I have the source code and I can fix whatever I think is wrong (whether I'm right or otherwise) with it and test it out in my Internet router. It's low level networking code that implements Linux's firewall.

I fiddle with VPN codes as well (mainly OpenVPN, but a little of WireGuard), so I know a little about VPNs and how it works. My Internet routers are all setup with VPN servers so that I can reach back to my home networks to get back resources I stores at home. That is how IMHO VPNs should be use, protecting private resources.

Computer networking is a complicated subject. Modern network stacks have mutiple routing tables, and certain OS implementations requires certain predictability in terms of how data packet travels so that it does not affect the app layer functionalities. Implementing networking codes for one OS need ones to understand truly what the OS offers. Not all OSes behaves the same.

Besides, using a VPN service to access the Internet for security reason is not a good use of VPN IMHO. There's no security offered by the VPN service if the Internet resources you access are served in the clear. From the privacy aspect, it is also non-existent. You are just transfering your access pattern from your ISP to the VPN service provider. Once you go online, you leave a digital trail. Anyone determined enough to track you with the resources to do it will be able to.

All the complains in this thread seems like a tempest in a teapot.

 

[Abazigal]

Most people don’t even understand the concept of a VPN much less if it’s working. They just see their favorite YouTube celeb selling it and think oh I need that. I had a family member tell me they got a VPN subscription. I asked why. They said oh it makes the Internet more secure so they can’t be tracked online. Yeah no not even close. What upsets me is I’ve seen some of the ads and they’re highly misleading. I think most of these companies are outside the US, UK and EU so they’re probably protected from any kind of false advertising litigation. If you’re someone who uses a VPN just because you don’t want to be tracked by your ISP you might want to look at who owns most of these VPN services. You might as well sign up for Facebook or Google VPN if there was such a thing 😂

Methinks there's a place for Apple to do for the VPN app market what they did with weather. We have private relay for Safari, and I also have the lockdown app installed on my phone (which blocks trackers on a device level). I feel that Apple could acquire a company like Lockdown and implement tracker blocking on a hardware level (ie: have the app preinstalled on every Apple device). This could also pave the way for an Apple VPN service and extend private relay to the entire device.

Perhaps the best way is to simply do it yourself.

 

[buklauu]

From reading the article it only leaks data if you’ve previously established a connection before the VPN started.

So if you have booted your phone and started a VPN and never turned it off, it doesn’t leak right?

Do people turn on and off their VPN routinely? Maybe if you do that you have problems…

It’s seems just never turn your VPN off and it can’t happen.

Can you really be sure nothing establishes during boot before the VPN actually 'kicks in'?

 

[russell_314]

Methinks there's a place for Apple to do for the VPN app market what they did with weather. We have private relay for Safari, and I also have the lockdown app installed on my phone (which blocks trackers on a device level). I feel that Apple could acquire a company like Lockdown and implement tracker blocking on a hardware level (ie: have the app preinstalled on every Apple device). This could also pave the way for an Apple VPN service and extend private relay to the entire device.

Perhaps the best way is to simply do it yourself.

I guess it would be okay but I don't think it would be any better than other VPN providers. My trust in Apple when it comes to privacy has eroded when they started on device scanning for CSAM. I hate CSAM but I don't think the answer is searching everyone's device without a reason or probable cause as we say in the USA. I like the idea of private relay but it causes me problems with my banking sites. Some won't let me log in and others constantly ask for 2FA. I don't think it gets around device fingerprinting so I'm not even sure it's worth it.

I could do a VPN to my home but I would need to do lots of research on that because I hear if done wrong it can be a security risk. If I'm not mistaken I would also need a static IP address so maybe not something I can get with a home internet plan. I know enough about networking to get me in trouble 🤣

 

[dlopan]

If Apple is indeed messed up the api for vpn's they need to be sued (again) to fix this. I'm tired of hearing about Apple messing up this and that. Sue first, ask questions later.

 

[Artemis70]

Methinks there's a place for Apple to do for the VPN app market what they did with weather. We have private relay for Safari, and I also have the lockdown app installed on my phone (which blocks trackers on a device level). I feel that Apple could acquire a company like Lockdown and implement tracker blocking on a hardware level (ie: have the app preinstalled on every Apple device). This could also pave the way for an Apple VPN service and extend private relay to the entire device.

Perhaps the best way is to simply do it yourself.

I would really like Apple to implement the blocking concepts from Lockdown in the OS, with options in the Privacy settings. It amazes me that we can ask the OS to not allow tracking, but that many apps still do track even when that setting is turned off. The Privacy Report clearly shows this. I'm not sure if I should report these apps to Apple, and where. It appears that any app written in React has this behavior, although that is a guess.

 

[chucker23n1]

Not really. This will be dangerous to just trust one category of apps. Nothing stops a bad actor from creating an app pretending to be a VPN app.

And yet that is exactly how the App Store process works and always has. You ask for an additional entitlement (without it, you can't use the API), and App Review presumably applies extra scrutiny.

IMHO the security model for a mobile device is very much different from a desktop computer. For a computer model, you trust the login account and assign the rights to the apps running under that accounts rights (e.g. root, users, etc.)

macOS's security model no longer looks like that. It relies heavily on mechanisms such as TCC and sandboxing, which apply even if you aren't root. The notion that a non-root app should feel free to muck around with your entire home directory was fine in the 1970s but isn't today.

For a mobile devices, since there's no concept of user account, the model is basically to restrict apps' ability to do stuffs.

iOS has root just like macOS does.

Seems like you don't know what is the Linux netfilter sub-system.

It's not relevant. Open-source VPN apps for iOS exist if that's your concern.

I fiddle with VPN codes as well (mainly OpenVPN, but a little of WireGuard), so I know a little about VPNs and how it works. My Internet routers are all setup with VPN servers so that I can reach back to my home networks to get back resources I stores at home. That is how IMHO VPNs should be use, protecting private resources.

And Apple disagrees and offers broader use cases for VPNs.

I'm not sure why some of you keep arguing this since it's the entire premise of this article. If you think VPNs should only be for giving access to private resources, that's fine. Connect to the VPN, you get access. Disconnect, the routes get removed and existing connections won't work any more. This discussion is not about that.

Besides, using a VPN service to access the Internet for security reason is not a good use of VPN IMHO. There's no security offered by the VPN service if the Internet resources you access are served in the clear. From the privacy aspect, it is also non-existent. You are just transfering your access pattern from your ISP to the VPN service provider.

There is a privacy aspect in that it obscures your original location.