IOS Vulnerability Prevents VPNs From Encrypting All Traffic - MacRumors

Ruben Fields
March 30, 2020

Despite all the issues identified with iOS 13, a large portion of the user base never seems to be deterred, though owners of new iPhones didn't get the option, as iOS 13 is baked into the iPhone 11 series. This will kill all Internet connections and temporarily disconnect the VPN.

Various users have confirmed that they have lost mobile cellular coverage with the installation of iOS 13.3, and some also claim loss of Wi-Fi and can not make phone calls or send regular text messages.

ProtonVPN is upfront about the fact that, for most connections, this will not matter too much.

"Most connections are short-lived and will eventually be re-established through the VPN tunnel on their own", ProtonVPN said. As a rule, the operating system closes all previous connections when a VPN is opened and automatically reconnects to the original target servers via the VPN tunnel. The Apple's push notification server work with the long lived connection and the connection lives for longer hours outside the tunnel.

As per the reports this bug is still not fixed in latest iOS 13.4 updates, so the users of iOS 13.4 will face the same issue even after updating their Apple devices.

ProtonVPN looked into this vulnerability using Wireshark to capture the entire network traffic of an iOS device that was running on the affected version of iOS.

Apparently, iOS is not terminating all existing internet connection when the user connects to a VPN.

NetflixParty.com makes your Netflix binge a bit more social
Can you get and use Netflix Party on iPhone and Android mobile devices, though? Browse Netflix for your favorite movies and shows. The "hack" allows for multiple people to connect and remotely watch Netlfix programming while having chat conversations.

Instead of ending all network connections and restarting them with encryption, iOS keeps all previously existing network connections open. But there is no reason why other apps and connections couldn't wind up in the same position. This unpatched security vulnerability prevents VPN networks from encrypting all traffic and can cause some Internet connections to bypass VPN encryption exposing the user's data or IP address.

ProtonVPN has assessed this vulnerability as being of a medium level of severity. Among other concerns, messaging applications can also be affected. ProtonVPN has disclosed the issue through a blog post to make all VPN providers and end users aware of its scope.

ProtonVPN has shared the findings with Apple, which has acknowledged the problem and "is now looking into options on how to fully mitigate it". This may lead to exposing the user's personal and location data. There is no evidence to support such a theory at present and Apple is yet to comment on the vulnerability at the time of writing beyond acknowledging its existence.

Until a fix will be provided, Apple recommends using Always-on VPN to mitigate this problem.

Should the connection have been encrypted, they would have expected to see traffic only between the device's IP and the VPN server or local IP addresses.

It is to ProtonVPN's enormous credit that they have taken this issue seriously when it was flagged to them.

Other reports by

Discuss This Article

FOLLOW OUR NEWSPAPER