iPhone VPN safety points persist in iOS 16, researchers declare

Two years in the past, Proton VPN discovered a vulnerability in Apple’s iOS that enables a person’s VPN visitors to circulate outdoors the VPN tunnel, unencrypted.

The vulnerability was initially stated to have an effect on iOS model 13.3.1. Bubbles VPN additionally warned about this issue in 2020. And this yr, researcher Michael Horowitz stated that the vulnerability exists in iOS version 15.6.1.

now, new research claims that the vulnerability nonetheless exists in iOS 16, the model new model of Apple’s cell working system. Safety researchers at Musk have demonstrated that iOS 16 communicates with Apple providers outdoors of an asset VPN tunnel and points DNS requests.

“We affirm that iOS 16 communicates with Apple providers outdoors of an lively VPN tunnel,” the researchers wrote on Twitter. “Worse, it leaks DNS requests. Apple providers that escape the VPN connection embody Well being, Maps, Pockets.”

VPN customers with critical need for privacy reminiscent of journalists, dissidents and activists are significantly in danger if their visitors is leaked.

Usually, when a person connects to a VPN, current web connections have to be terminated by the working system after which re-established by way of the encrypted VPN tunnel. Leaking unencrypted information outdoors an lively VPN tunnel can pose severe privateness and safety dangers as a result of a person’s actual IP deal with and different delicate data may be uncovered to the person’s ISP, community directors, companies authorities and cybercriminals.

Moreover, the researchers confirmed that the data leaks continued even with Apple information Lock mode activated. Actually, they are saying the leaks had been worse that manner.

Apple didn’t instantly reply to CNET’s request for remark. However according to Apple’s websiteBlock Mode is “optionally available, excessive safety that’s designed for the only a few people who, due to who they’re or what they do, could also be personally focused by a number of the most refined digital threats.”

Proton VPN described a potential resolution in it blog post documenting the problem. Customers should first connect with a VPN server, allow Airplane Mode on their iOS system (to kill all web connections and quickly disable the VPN), after which disable Airplane Mode. The VPN ought to then be reconnected and all web connections ought to be re-established by way of the VPN tunnel. Nevertheless, Proton VPN warns that there is no such thing as a 100% assure that this methodology will work.

“That is one thing that has sadly continued regardless of us repeatedly elevating the problem with Apple over a protracted time period. Understanding this, it is value reiterating that this situation is a byproduct of an iOS bug, not some sort of bug inside Proton VPN,” a Proton spokesperson informed CNET in an emailed assertion. “The leak additionally impacts VPN providers throughout the board, not simply Proton. This case is clearly suboptimal, however it doesn’t expose customers’ searching historical past or different on-line actions.”