Live data from Hacker News

iOS allows DNS request to escape the VPN tunnel

twitter.com

71–78 of 78 posts

Re: iOS allows DNS request to escape the VPN tunnel

#71

Earlier quoted context omitted.

Cheating the location on my phone is gravy. Broadcasting an RF signal to spoof GPS (and especially across a campus), that my friend, is not trivial or cheap.

Trying to set up an alternate 3d volume of GPS space sounds very difficult. But broadcasting a loud signal that tells everyone in range that they are at the same exact point doesn't seem too hard to me. Couldn't that even be as simple as replaying a single-antenna recording taken somewhere else?

Yes exactly.

Doesn't work well with some receivers that cache data from the real network and stay locked onto the much weaker real signal. But works with most receivers.

Re: iOS allows DNS request to escape the VPN tunnel

#72

And remember... This is WiFi. But over the LTE connection, which is far harder to sniff without very expensive equipment, it could be doing almost anything. And you can't even check what it's doing.

can you not sniff it with services like nextdns?

Re: iOS allows DNS request to escape the VPN tunnel

#73
post #2

> We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.We used @ProtonVPN and #Wireshark

Wallet at least has a semi-plausible non-evil answer: Users who kick their VPN on to another country and try to use apple pay at checkout will unexpectedly get declined (because the purchase would appear to be coming from another country perhaps?). Apple could fix that with proper UI though.

Isn't it only matters what payment terminal bank's country is?

Re: iOS allows DNS request to escape the VPN tunnel

#74
post #72

And remember... This is WiFi. But over the LTE connection, which is far harder to sniff without very expensive equipment, it could be doing almost anything. And you can't even check what it's doing.

can you not sniff it with services like nextdns?

I assume that anything evil going on wouldn't use the configured DNs servers... Just like things also bypass the configured VPN...

Re: iOS allows DNS request to escape the VPN tunnel

#76
post #44

Earlier quoted context omitted.

We will need to keep a list of DNS IPs to block access through ports 80 and 443.

And what happens when they start changing the port? It's a battle no one ultimately can win, in short term. The technical options available to get DNS by so many different means are so easy to implement, relatively speaking. Even a really junior engineer can likely invent their own DNS resolution protocol, its one of the simplest APIs to reinvent if all you care about is returning IP address for a given name. 80 and…

Fine. Block that IP on every port.

Re: iOS allows DNS request to escape the VPN tunnel

#77
post #44

Earlier quoted context omitted.

And what happens when they start changing the port? It's a battle no one ultimately can win, in short term. The technical options available to get DNS by so many different means are so easy to implement, relatively speaking. Even a really junior engineer can likely invent their own DNS resolution protocol, its one of the simplest APIs to reinvent if all you care about is returning IP address for a given name. 80 and…

Fine. Block that IP on every port.

I don't think you really appreciate the scale of the problem, when any protocol can be used. Port/IP blocks simply are too blunt now, and once again you are screwed if app provider uses the same IP for illegitimate DNS as legitimate services - you might not be able to block the IP at all and still access the services you need on that device or application. To give one example - imagine if netflix shared video on same IP as their private DNS service. They could even use the same port. Can't block the DNS without blocking the service.

Heaven forbid they use dynamic IP/port allocations too...

Re: iOS allows DNS request to escape the VPN tunnel

#78
post #26

Earlier quoted context omitted.

> PiHole arguably is getting less effective with each passing year as alternate DNS resolution methods like DNS over HTTPS etc gain traction, and defeating DNS over HTTPS is s a whack-a-mole game today, all you can really do is try to blacklist known DNS over HTTPS server IPs, which is a running battle. Aren't blocking ads another whack-a-mole? So it seems like more of the same. Also, aren't there proxies that you ca…

The key difference is the point of control: For PiHole today, most everything comes over port 53, and thus easy to track, monitor and block as required. Tomorrow, DNS requests can be on any port, to any server, on any protocol. This makes trying to use a single point of control like the PiHole so much harder than it was in the past. Who is to say next week its HTTPS as the encrypted transport for DNS? Use whatever bi…

Eventually ads, tracking, etc are just going to be proxied by the app server, along with normal app server traffic, to one IP and you can't do much effective filtering in the end.
Post reply on HN