Mullvad: Android can leak information when connected to a VPN

Secure and private VPN provider Mullvad discovered that Android devices can leak information when connected to VPN services, which cannot be prevented.

According to Mullvad’s information, Android uses connectivity checks outside the VPN tunnel when devices connect to wireless networks. What makes this even worse is that it happens even if the device has the Block Connections without VPN security feature enabled.

Data connections that occur outside the boundaries of the VPN connection are made as intended. Mullvad gives the example of captive portals on networks, which require users to authenticate before connectivity is available. Most Android users may want these checks, notes Mullvad.

The leak is raising privacy concerns for some. Users can trust that their connection is protected from leaks when using VPNs on Android. The entity controlling the connectivity verification server and any entity monitoring network traffic can obtain the data. The metadata includes the source IP address and can be used to “derive additional information,” according to Mullvad; this would require a “sophisticated actor” according to the company.

Android does not include user-facing options to disable traffic that goes outside the VPN tunnel. Mullvad published guide to disable connectivity check on Android. It requires development tools and is technical in nature.

The company reported the problem to Google, which replied with a status of “will not fix” for the problem, indicating that this is the intended behavior.

“We’ve reviewed the feature request you reported and want to let you know that this works as intended. We think such an option would be understandable to most users, so we don’t think there’s a strong reason to offer this.”

Google’s main arguments are that other traffic is exempt from this, that some VPNs may use connection information, and that little data is revealed during these checks. Mullvad argues that data leaks matter to some users and that those users should be given the option to block any leaked traffic if they want to.

Android users who need complete leak protection have only one option: to mod their device using Mullvad’s guide to block these links.

Now you: Do you use VPN connections on your mobile devices?

Summary

Title of the article

Mullvad: Android can leak information when connected to a VPN

Description

Secure and private VPN provider Mullvad has discovered that Android devices can leak information when connected to VPN services, which cannot be prevented.

The author

Martin Brinkmann

Publisher

Ghacks Technology News

Logo

Advertisement