Info VPN bypass vulnerability in Apple iOS

[WST16]

VPN bypass vulnerability in Apple iOS | Proton

We discovered a security vulnerability in Apple’s iOS that causes connections to remain unencrypted even after connecting to VPN.

protonvpn.com

 

[fredbert]

Looks to be some existing connections don't get reset and sent down the VPN tunnel, unless you're using a VPN service that reconnects after network change/interruption (e.g OpenVPN does and native iOS L2TP/IPsec doesn't). If your VPN client reconnects then setup the tunnel and toggle airplane mode off/on to force connections to restart.

Guessing this is in the scenario where you've opted to send al traffic down the tunnel: so split-tunnelling isn't affected as such since you're already sending only selected traffic down the tunnel.

Haven't had time to look any deeper.

 

[Shadow]

With probaly 90% of the Internet traffic nowadays now VPN traffic due to many people working from home (due to Corona virus), this may come at a bad timing for Apple.

 

[WST16]

Yes, not good at all for a company that prides itself on being very secure and a privacy advocate.
It must be all that focus on more and more stupid Memojis

 

[WST16]

With probaly 90% of the Internet traffic nowadays now VPN traffic due to many people working from home (due to Corona virus), this may come at a bad timing for Apple.

Something interesting I read today

Walmart sees increase in sales of tops, but not bottoms, curiously

Business on top, party on the bottom has become the standard office dress code during the coronavirus crisis.

www.cleveland.com

 

[fredbert]

Yes, not good at all for a company that prides itself on being very secure and a privacy advocate.

Would most of the new VPN remote access be using mobile devices or desktop/laptop? It's not good that's for sure. And I'd guess most connections won't use split-tunnelling, unless there's an on-device/cloud security product that protects direct access.

As for selling more tops than bottoms: video conferencing :p

 

[Danabw]

As for selling more tops than bottoms: video conferencing

Absolutely...my wife is now working from home full time. WFH video-conference outfit:

• Biz casual top
• pajama bottoms/sweatpants
• slippers