Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android NAT-T keepalive offload bypasses VPN lockdown

supuk.ch

Post reply on HN
Print view View original

61–68 of 68 posts

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#61

Post by ValdikSS »

ysnp wrote: post #60
ValdikSS wrote: post #50

Android has a way to bind the socket to the interface: Network.bindSocket, this is a setsockopt(SO_BINDTODEVICE) wrapper with access control. The access to it is controlled by the VPN application. Some applications could be allowed to connect directly when the VPN is active and routing all the traffic by default, some could use VPN if configured not to use it by default. However starting with Linux kernel 5.7, the un…

Can you report this to GrapheneOS?

It has been reported to Google (as a security bug) and to GrapheneOS as a comment in one of the very similar VPN leak issue on github. GrapheneOS has deleted my comment, probably because they assumed it was AI-generated or something, I've copied the report I sent to Google there.

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#62

Post by fwn »

grapheneos wrote: post #33
exceptione wrote: post #31

Earlier quoted context omitted.

I am not sure why all your comments are flagged, but here is my response to your other comment: > We plan to heavily overhaul the VPN implementation to make most forms of leaks nearly impossible rather than continuing to use the current system prone to it. Thanks, great to hear. Given the slew of bugs you uncovered it seems the Android implementation has some rough edges. Would `pasta` be helpful to you? It allows yo…

> I am not sure why all your comments are flagged The past couple weeks of our replies were maliciously flagged. We've made a post about it on social media as we've had to do before when this happens. This happens very regularly to posts by GrapheneOS or posts which simply support GrapheneOS. There are a bunch of malicious accounts which show up to each thread about GrapheneOS to make personal attacks towards our tea…

This comment specifically was also auto-collapsed for me, without being marked as flagged or dead.

It might help to ask moderation about this. Could be an artefact of brigarding or something similar.

I also wouldn't worry about individual accounts so much. Asking for others to be banned, linking mirrored profiles, etc. That is just not the stuff many users like to read on HN. I think your technical content is truly amazing on its own already.

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#63

Post by grapheneos »

dcminter wrote: post #53
grapheneos wrote: post #40

Earlier quoted context omitted.

The past several weeks of our replies were wrongly flagged. None of our posts were in any way inappropriate and it's entirely appropriate to ask for help getting it undone. On the other hand, you're repeatedly making personal attacks on our team, engaging in doxxing and spreading harassment content. You're directly pointing people to Kiwi Farms harassment content with blatant libel and doxxing. There have been years…

Perhaps this is a stupid question, but have you emailed the moderators (rather than assuming they're aware of the issue) ?

We've previously emailed them with no result. This time around we got a reply about this specific account targeting us but it isn't resolved. We don't have much optimism about getting the many past threads with personal attacks based around fabricated stories and harassment content addressed without doing more than asking via email.

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#64

Post by jasomill »

codedokode wrote: post #52
unethical_ban wrote: post #49

Earlier quoted context omitted.

Not every pocket thief or drunkard who finds your phone has cellebritr. Security measures consider the threat model. More specifically, another commenter in this thread says it's to make sure the user is aware of the configuration of a VPN which, if done maliciously, funnels all your traffic toa a hostile place.

A pocket thief will bring the phone to a friend with a laptop and black market software. If the phone has no theft protection, they will factory reset it; if it has, they will use paid software to remove protection. I have not used that software and do not know if it is actual now, but Internet search shows that older phones are completely unlockable. Just to give an example, here is publicly available information: h…

Non-malicious VPN software can be used by malicious actors to route packets through servers they control.

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#65

Post by aucisson_masque »

grapheneos wrote: post #29
aucisson_masque wrote: post #4

> This issue is not public, but based on this information we deem it unlikely that Google will do anything about it. GrapheneOS is aware of the issue and are working on a fix. Good guy Google, as usual.

See https://news.ycombinator.com/item?id=49672677 .

Interesting

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#67

Post by exceptione »

ValdikSS wrote: post #50

Android has a way to bind the socket to the interface: Network.bindSocket, this is a setsockopt(SO_BINDTODEVICE) wrapper with access control. The access to it is controlled by the VPN application. Some applications could be allowed to connect directly when the VPN is active and routing all the traffic by default, some could use VPN if configured not to use it by default. However starting with Linux kernel 5.7, the un…

Imho, the interface should not even be in the namespace to begin with. Unshare netns, then using pasta allows you to pass a user-space network adapter inside. https://passt.top/passt/about/

Caveat: I am no expert on Android.

Re: Android NAT-T keepalive offload bypasses VPN lockdown

#68

Post by codedokode »

jasomill wrote: post #64
codedokode wrote: post #52

Earlier quoted context omitted.

A pocket thief will bring the phone to a friend with a laptop and black market software. If the phone has no theft protection, they will factory reset it; if it has, they will use paid software to remove protection. I have not used that software and do not know if it is actual now, but Internet search shows that older phones are completely unlockable. Just to give an example, here is publicly available information: h…

Non-malicious VPN software can be used by malicious actors to route packets through servers they control.

How does PIN help against this? Also, my packets are already routed through malicious actors - ISPs, luckily most of them are encrypted.
Post reply on HN