Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS VPNs have leaked traffic for years, researcher claims

arstechnica.com

Post reply on HN
Print view View original

31–40 of 40 posts

Re: iOS VPNs have leaked traffic for years, researcher claims

#31

Post by gruez »

ryp35 wrote: post #30
rsync wrote: post #19

This is why I use a "slug" when I use a VPN: https://john.kozubik.com/pub/NetworkSlug/tip.html "A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces ..." "So, while the device participates on the physical layer of the (probably ethernet) network, it does not have an IP address and cannot answer IP (or even ICMP) requests ..." In my case, if I needed a VPN, I would…

Hi! Would you please spare some time and provide more details of your setup? Thanks in advance

Not the OP but an example of such a setup would be connecting your ios device to a router that has firewall rules to only allow UDP port 51820 (ie. wireguard) to go through. That way if there's any traffic leakage from your ios device, nothing will get out because of the firewall on your router.

Re: iOS VPNs have leaked traffic for years, researcher claims

#32

Post by rsync »

ryp35 wrote: post #30
rsync wrote: post #19

This is why I use a "slug" when I use a VPN: https://john.kozubik.com/pub/NetworkSlug/tip.html "A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces ..." "So, while the device participates on the physical layer of the (probably ethernet) network, it does not have an IP address and cannot answer IP (or even ICMP) requests ..." In my case, if I needed a VPN, I would…

Hi! Would you please spare some time and provide more details of your setup? Thanks in advance

The URL I posted is an "Iceberg Article"[1] - this is the "tip":

https://john.kozubik.com/pub/NetworkSlug/

... and this is the body underneath:

https://john.kozubik.com/pub/NetworkSlug/body.html

... and that is where you can see some details of what a "slug" looks like and how they may be set up, etc.

[1] https://john.kozubik.com/pub/IcebergArticle/tip.html

Re: iOS VPNs have leaked traffic for years, researcher claims

#33

Post by rsync »

gruez wrote: post #31
ryp35 wrote: post #30

Earlier quoted context omitted.

Hi! Would you please spare some time and provide more details of your setup? Thanks in advance

Not the OP but an example of such a setup would be connecting your ios device to a router that has firewall rules to only allow UDP port 51820 (ie. wireguard) to go through. That way if there's any traffic leakage from your ios device, nothing will get out because of the firewall on your router.

Correct - however, what you are describing is a normal firewall.

What distinguishes a "slug" is that it is not on the TCP/IP network - you cannot connect to it - and it acts as a "dumb" chokepoint that cannot be misconfigured or attacked or co-opted by other actors or software.[1]

Further, it is a physical, wired device with exactly two ports so you can conceptually witness - with your eyes - how your traffic is locked to whatever VPN you may be using.

[1] Yes, of course it can but when we think of a layer 2 bridge with no TCP/IP connectivity being attacked by a remote actor ... we're bordering on science fiction. For what it's worth, the FreeBSD filesystem I use on my slugs is mounted read-only. Defense in depth.

Re: iOS VPNs have leaked traffic for years, researcher claims

#35

Post by jkaplowitz »

thrapple wrote: post #28

This isn't news, really - folks who actually work with large-scale deployments (and management) of iOS devices (particularly devices with cellular connectivity or which need to access random wifi networks) already know that the only real always-on VPN capability in iOS is IKEv2 pushed via your MDM system of choice. This has been true since the capability was first released in (IIRC) iOS 8. Yes, it's hella-lame Apple…

Neat tip! So this will ensure that all connections including Apple's push notification service always go through the VPN?

How does this interact with public wifi captive portals, which often are a barrier to get online in the first place? A pretty common need would be to click through the public portal, sometimes dealing with email verification links or Facebook logins for those portals that require identifying oneself, and then to want 100% of traffic after the Internet connection is open to go through the VPN.

In other words, road warriors with security concerns need a solution that is NOT always-on but is comprehensive when on. Apparently iOS doesn't support this as per the article, and the always-on MDM suggestion isn't that either.

Re: iOS VPNs have leaked traffic for years, researcher claims

#36

Post by JumpCrisscross »

semi-extrinsic wrote: post #29
Terretta wrote: post #21

Earlier quoted context omitted.

Who is “you”? Multiply “you” by all possible “yous”, multiplied by downsides of “just install an app” not vetted, for those “yous”. What’s the net effect on total privacy or safety of all yous out there? If “you” are here on HN, odds are you are a vanishingly small part of the venn diagram of yous that should inform an iPhone PdM’s thinking on this issue. EXCEPT, of course, for the NPS (net promotor score) / influenc…

Well, Android has been successful for years now with a model where it is possible to sideload an APK on any device, but it's buried sufficiently deep that the people who shouldn't be using it can't find it. Why not replicate that (IMO) success? Because if I understand GP correctly, they are talking about the ability for devs and white hats to install software which enables debugging and logging so it becomes much eas…

> Why not replicate that (IMO) success?

We have two models. People who like one can choose that. People who don’t can choose this. Sometimes solutions have multiple equilibria.

Re: iOS VPNs have leaked traffic for years, researcher claims

#37

Post by smoldesu »

JumpCrisscross wrote: post #36
semi-extrinsic wrote: post #29

Earlier quoted context omitted.

Well, Android has been successful for years now with a model where it is possible to sideload an APK on any device, but it's buried sufficiently deep that the people who shouldn't be using it can't find it. Why not replicate that (IMO) success? Because if I understand GP correctly, they are talking about the ability for devs and white hats to install software which enables debugging and logging so it becomes much eas…

> Why not replicate that (IMO) success? We have two models. People who like one can choose that. People who don’t can choose this. Sometimes solutions have multiple equilibria.

I agree. Apple should implement both models, and then you can choose for yourself. No downside!

Re: iOS VPNs have leaked traffic for years, researcher claims

#38

Post by JumpCrisscross »

smoldesu wrote: post #37
JumpCrisscross wrote: post #36

Earlier quoted context omitted.

> Why not replicate that (IMO) success? We have two models. People who like one can choose that. People who don’t can choose this. Sometimes solutions have multiple equilibria.

I agree. Apple should implement both models, and then you can choose for yourself. No downside!

> No downside!

Of course there is. Facebook and Oracle would immediately have some mandatory spyware you’d need to install. Curtailing developers’ freedom is a favourable choice for many consumers. Apple reflects that market pressure. (Android, its inverse.)

Re: iOS VPNs have leaked traffic for years, researcher claims

#39

Post by DangitBobby »

JumpCrisscross wrote: post #38
smoldesu wrote: post #37

Earlier quoted context omitted.

I agree. Apple should implement both models, and then you can choose for yourself. No downside!

> No downside! Of course there is. Facebook and Oracle would immediately have some mandatory spyware you’d need to install. Curtailing developers’ freedom is a favourable choice for many consumers. Apple reflects that market pressure. (Android, its inverse.)

It's not like they don't already have that power, they can just force you to use an Android phone for work.

Re: iOS VPNs have leaked traffic for years, researcher claims

#40

Post by egberts1 »

simscitizen wrote: post #24
egberts1 wrote: post #2

Even WireGuard is also impacted on iOS. The author of WireGuard lamented that certain network pathway must be preserved for existing Apple infrastructure before WireGuard app can be approved and made available by Apple App Store. So, there is no easy way to catalogue what kind of cellular data traffic unless we magically ran a network capture (WireSHARK) at cell tower level or root our iOS phone. I do do know for iOS…

iOS has supported tcpdump for end users since...I can't remember, maybe iOS 4? https://developer.apple.com/documentation/network/recording_...

I actually used that but its filter selection of packets is also unknown.

It said so in the article you commented on:

    iOS doesn’t let you record a packet trace directly.
Post reply on HN