Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS allows DNS request to escape the VPN tunnel

twitter.com

Post reply on HN
Print view View original

41–50 of 78 posts

Re: iOS allows DNS request to escape the VPN tunnel

#41

Post by neilalexander »

bogomipz wrote: post #38
dljsjr wrote: post #9

Always-on VPN that tunnels everything requires MDM commissioning. It's documented by Apple. See the section "Always On VPN": https://support.apple.com/guide/deployment/vpn-overview-depa... Is it dubious that Apple doesn't let VPN apps do this as well? Maybe. But this is known and documented.

I'm not following. Your link appears to be specific to corporate environments. The title of the document is: "VPN overview for Apple device deployment." It further states "Secure access to private corporate networks is available in iOS ..." An individual iPhone user who is not using a company issued device would not be beholden to MDM restrictions or profiles. Nor would access to "private corporate networks" be neces…

You can create and install mobileconfig profiles on any iPhone, even unmanaged.

Re: iOS allows DNS request to escape the VPN tunnel

#42

Post by thelopa »

tablespoon wrote: post #15
jaywalk wrote: post #10

Earlier quoted context omitted.

I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS.

> I don't see any reason why Apple Pay would use IP geolocation like that when it's running on a device that has GPS. One reason is that GPS doesn't work well (or at all) indoors, through cell-tower geolocation should work well enough for that case.

A compromised device can send a false location or the user may have disabled location. Geolocation has relatively predictable failures.

Re: iOS allows DNS request to escape the VPN tunnel

#43

Post by imwillofficial »

zikduruqe wrote: post #35
ballenf wrote: post #30

Earlier quoted context omitted.

> some radios and antennas Still an impressive feat.

I'm calling shenanigans. I used to work in a lab where we had GPS repeaters to test consumer equipment. That alone costs big bucks. And, we had the FAA come down on us big time, because our GPS repeater broadcast outside the building too far and we got into some hot water. If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got…

Spoofing GPS is trivial. Getting caught or not is a toss of the coin

Re: iOS allows DNS request to escape the VPN tunnel

#44

Post by giobox »

timbit42 wrote: post #40
giobox wrote: post #14

Earlier quoted context omitted.

This doesn't stop apps using things like DNS over HTTPS etc. PiHole works pretty great today, but developers are getting sneakier and sneakier about how to obtain outbound DNS. It's not just unencrypted port 53 all the time anymore. Eventually devices will get the IP for the DNS record they want just fine, if they really want to. PiHole arguably is getting less effective with each passing year as alternate DNS resolu…

We will need to keep a list of DNS IPs to block access through ports 80 and 443.

And what happens when they start changing the port? It's a battle no one ultimately can win, in short term. The technical options available to get DNS by so many different means are so easy to implement, relatively speaking. Even a really junior engineer can likely invent their own DNS resolution protocol, its one of the simplest APIs to reinvent if all you care about is returning IP address for a given name.

80 and 443 are only used by convention for HTTP/HTTPS - you can use whatever the hell you like. There's also the option to not use HTTP(S) or DNS at all to obtain addresses, the list of ways you can avoid traditional methods is endless. Finally, you can just serve your DNS on same IP as back end of the app - block the IP and the app dies completely, meaning a simple IP block will not work etc etc. It's super easy to write some code that combines tens of methods, ensuring you get that DNS record no matter how hard the user tried to stop you.

FWIW people (including me) already do this, but its a blunt tool and not all that effective in many cases: https://gist.github.com/ckuethe/f71185f604be9cde370e702aa179...

Re: iOS allows DNS request to escape the VPN tunnel

#45

Post by roamerz »

giobox wrote: post #12
dljsjr wrote: post #9

Always-on VPN that tunnels everything requires MDM commissioning. It's documented by Apple. See the section "Always On VPN": https://support.apple.com/guide/deployment/vpn-overview-depa... Is it dubious that Apple doesn't let VPN apps do this as well? Maybe. But this is known and documented.

So many times law enforcement take advantage of this too, to fingerprint devices. The number of people caught because someone leaks packets outside the VPN for a few seconds because they forgot to configure VPN to disable outbound data if VPN drops... I've long wondered if making always on VPN require MDM provisioning on iPhones was a sop to police/criminal investigation forces, especially after Apple's public fights…

You used FBI and the term law enforcement in the same sentence. Sad to say the respect I once had for what the FBI likes and dislikes has been greatly diminished by the political bias that seems to influence it’s actions. I look forward to the day when they are strictly law enforcement and without political agenda. We as a country need them.

Re: iOS allows DNS request to escape the VPN tunnel

#46

Post by neilalexander »

joshstrange wrote: post #23
emptyparadise wrote: post #11

iOS devices are leaky as hell. I once tried blackholing all requests besides those to a VPN service on a router level, and even then my iPhone would just fall back to mobile data for notifications and other Apple services.

Completely different situation. The iPhone falls back to mobile data if it can't get to the internet over WiFi.

It’s also optional (called “Wi-Fi Assist”).

Re: iOS allows DNS request to escape the VPN tunnel

#47

Post by exabrial »

RetpolineDrama wrote: post #7
nb_key wrote: post #2

> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark

Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.

I disagree completely.

* first, a purchase shouldn't require an internet connection. Humans have been doing commerce for millennia without it, and we have sophisticated pub/priv key schemes to figure this all out.

* second, it's a security hole. It's either a VPN or it's not.

Re: iOS allows DNS request to escape the VPN tunnel

#48

Post by zikduruqe »

imwillofficial wrote: post #43
zikduruqe wrote: post #35

Earlier quoted context omitted.

I'm calling shenanigans. I used to work in a lab where we had GPS repeaters to test consumer equipment. That alone costs big bucks. And, we had the FAA come down on us big time, because our GPS repeater broadcast outside the building too far and we got into some hot water. If you were spoofing GPS campus wide over 1.544 GHz and had all your GPS sentences correct, with simple radios and antennas... and you hadn't got…

Spoofing GPS is trivial. Getting caught or not is a toss of the coin

Cheating the location on my phone is gravy.

Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.

Re: iOS allows DNS request to escape the VPN tunnel

#49

Post by CharlesW »

jacooper wrote: post #36
netfortius wrote: post #13

Add Android to this: https://mullvad.net/en/blog/2022/10/10/android-leaks-connect...

Android only leaks connection checks. While on IOS any system app doesn't use the VPN or DNS requests. VPNs are useless on iOS, and its made to be this way, again the "privacy OS" isn't privacy focused at all. https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php

From TFA: "Apple also said that the Always On VPN feature of MDM offers a fix. Mobile Device Management is over my head. […] According to Apple, MDM lets the corporate IT techies force all data leaving an iOS device to go to the company. But, MDM is is not available to consumers."

There appear to be several easy-to-use MDM solutions that cater to small businesses that would also work fine for families. Apple even has one, Apple Business Essentials.

Re: iOS allows DNS request to escape the VPN tunnel

#50

Post by dljsjr »

bogomipz wrote: post #38
dljsjr wrote: post #9

Always-on VPN that tunnels everything requires MDM commissioning. It's documented by Apple. See the section "Always On VPN": https://support.apple.com/guide/deployment/vpn-overview-depa... Is it dubious that Apple doesn't let VPN apps do this as well? Maybe. But this is known and documented.

I'm not following. Your link appears to be specific to corporate environments. The title of the document is: "VPN overview for Apple device deployment." It further states "Secure access to private corporate networks is available in iOS ..." An individual iPhone user who is not using a company issued device would not be beholden to MDM restrictions or profiles. Nor would access to "private corporate networks" be neces…

It's written that way because the target audience is enterprise IT folks who are managing fleets of employee devices, but you can freely use MDM profiles as a consumer. It's certainly not user-friendly which is why I commented that the way it works for VPN clients installed as apps could be seen as a dubious implementation.
Post reply on HN