iOS Vulnerability Prevents VPNs From Encrypting All Traffic
A vulnerability affecting iOS 13.3.1 and later prevents virtual private networks (VPNs) from encrypting all traffic, allowing some internet connections to bypass encryption, potentially exposing users' data and IP addresses.
A screenshot from ProtonVPN demonstrating exposed connections to Apple's servers that should be protected by the VPN
Details on the vulnerability were shared today by Bleeping Computer after it was discovered by ProtonVPN. The vulnerability is caused because iOS isn't terminating all existing connections when a user connects to a VPN, allowing them to reconnect to destination servers once the VPN tunnel has been established.
Connections made after connecting to a VPN on an iOS are not affected by this bug, but all previously established connections are not secure. This could potentially lead to a user who believes they are protected accidentally exposing IP an address and therefore, an approximate location.
Apple's Push Notifications are cited as an example of a process using connections on Apple's servers that aren't closed automatically when connecting to a VPN, but it can affect any app or service running on a user's device.
VPNs cannot work around the issue because iOS does not allow VPN apps to kill existing network connections, so this is a fix that will need to be implemented by Apple. Apple is aware of the vulnerability and is looking into options to mitigate it.
Until fixed, VPN users can connect to a VPN server, turn on Airplane Mode and then turn off Airplane Mode to kill all existing connections. The mitigation isn't entirely reliable, however, so iPhone and iPad owners who rely on VPNs should be careful until Apple puts out a fix.
Popular Stories
The European Parliament today voted overwhelmingly in favor of enforcing USB-C as a common charging port across a wide range of consumer electronic devices, including the iPhone and AirPods, by the end of 2024.
The proposal, known as a directive, forces all consumer electronics manufacturers who sell their products in Europe to ensure that a wide range of devices feature a USB-C port. This...
Rumors suggest that Apple still has several new devices that are coming before the end of the year, including a range of Macs and iPads. It's not looking like we're going to get an October event in 2022, but refreshes are coming soon, probably via press release. If you're planning to buy a Mac or an iPad, make sure to check out our list to know what's safe to pick up now and what's not.
iPad ...
iOS 16 was released to the public three weeks ago with a customizable Lock Screen, the ability to edit iMessages, improvements to Focus modes, and much more. And in the coming months, iPhone and iPad users have even more new features to look forward to.
We've rounded up 10 new features coming to the iPhone and iPad later this year, according to Apple. Many of the features are part of iOS...
Apple today released updated firmware for the MagSafe Charger that is designed to work with the iPhone 12 and later and the AirPods Pro 2. The new firmware is version 10M1821, up from the prior 10M229 firmware. Note that in the Settings app, you'll see a different version number than the firmware number, with the update displayed as version 255.0.0.0 (the prior firmware was 247.0.0.0). The...
Apple on September 23 officially launched the second-generation version of the AirPods Pro, introducing updated Active Noise Cancellation, Adaptive Transparency, improved sound, and more. Right around the same time, Bose introduced new QuietComfort II earbuds with many similar features, so we thought we'd compare the two to see which has the edge.
Subscribe to the MacRumors YouTube channel for ...
One of iOS 16's most praised features comes at the cost of draining battery life, according to recently published Apple support documents.
The feature, known as "keyboard haptics," is optional in iOS 16 and allows users to get physical feedback via slight vibrations upon the touch of each key, confirming that it was pressed much like keyboard sounds. The feature is a useful addition to the...
Apple is no longer expected to host an event this month, despite plans to unveil a host of new devices including new iPad and Mac models, according to recent reports.
In recent months, Apple has been expected to hold an event in October to announce a range of products that did not receive any stage time during the company's iPhone 14 unveiling event last month. In a recent newsletter, Bloombe...
iOS 16.0.2 was released last month with several bug fixes for iPhone 14 issues, excessive copy and paste permission prompts, and more. Now, evidence suggests that Apple is planning to release iOS 16.0.3 with additional bug fixes.
Evidence of an upcoming iOS 16.0.3 software update has shown up in MacRumors analytics logs, which have been a reliable indicator in the past.
There are several...
Apple today seeded the fourth beta of iOS 16.1 to developers for testing purposes, with the beta coming one week after the release of the third iOS 16.1 beta. The iOS 16.1 beta is also joined by the fifth beta of iPadOS 16.1, which is on a slightly different schedule as Apple started testing it prior to the launch of iOS 16.
Registered developers can download the iOS 16 and iPadOS 16...
With the latest iOS 16.1 beta, Apple has tweaked the design of the Dynamic Island on the iPhone 14 Pro and Pro Max to make it more visible on a dark background. When using a darker wallpaper or with the darker interface of Dark Mode activated, there is a light gray border around the outside of the Dynamic Island when the screen is dimmed or when the Dynamic Island is in active use.
The...
Top Rated Comments
iOS used to handle this correctly, then stopped.
Not tearing down existing connections completely undermines the point of a VPN.
TCP is designed to retry after being torn down. It’s no biggie.
The fact is, this is an iOS bug, which was introduced recently.
If a VPN is configured to send all network traffic through the VPN when it’s running - which is typically what‘s done - then all traffic should be routing through it from the moment it’s enabled. Not just connections to new end points established afterward - all traffic.
Even if a VPN is configured to just carry traffic to a few specific end points (such as the OpenVPN tunnel to our servers, which I’m relying on heavily right now due to the stay at home order currently in place here in Washington): if you’re already connected to one of those end points before establishing the tunnel, you would expect all further traffic to go through the tunnel. The idea that you wouldn’t is ludicrous.
There’s actually two types on iOS. Split vpn and full tunnel. Split allows some stuff to be routed elsewhere. Full tunnel tunnels everything.