iPhone: VPNs on iOS leak our data

Traffic and data leaks, even after enabling a VPN, have been seen on iOS. Not all information immediately passes through the VPN tunnel.

“VPNs on iOS are a scam”, is the title of a long, frequently updated article by Michael Horowitz, a blogger specializing in computer security. According to him, VPN apps for iPhone are “broken” and don’t work as they should, leaving user data unprotected.

“At first they seem to be working well. The iOS device gets a new public IP address and new DNS servers. The data is sent to the VPN server. But, over time, a detailed inspection of the data leaving the device on iOS shows leaks in the VPN tunnel”explains the expert. “Data leaves the iOS device outside the VPN tunnel. It’s not a classic DNS leak, it’s a data leak. I confirmed this by using several types of VPNs and software from several VPN providers. The latest version of iOS that I tested is 15.6”he said.

Data leaks with VPNs on iOS

Normally, a VPN closes all insecure connections when it is activated, passing data through a tunnel of its creation, which is secure. According to the researcher, iOS does not allow closing all these connections, which means that some traffic continues to be handled usually the first few minutes after activating the VPN. In the case of push notifications, it is even possible that the data is not protected by the VPN for hours.

Apple is however aware of this very important problem, which puts its customers in a situation of danger. As early as March 2020, such data leaks had been documented by ProtonVPN on iOS 13. The Cupertino company did not react at the time, while it bases its communication on the security of its system.

It appears that Apple now makes a feature available to developers to solve the problem, but that it is disabled by default.

Source : Michael Horowitz