Slashdot Mirror
VPN Encryption Vulnerability On Android
An anonymous reader writes "Cyber security labs at Ben Gurion University have uncovered a network vulnerability on Android devices which has serious implications for users of VPNs. This vulnerability enables malicious apps to bypass active VPN configuration (no root permissions required) and redirect secure data communications to a different network address. These communications are captured in clear text (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure."
Better blacklist windows, apple, blackberry, desktops, laptops.... Everything is vulnerable. Even your users. Its how you mitigate the ongoing risk that separates the men from the boys.
If you are competent enough to use MDM on your mobile devices then your end users wouldn't be installing non-approved apps anyway so they would be at minimal risk of exposure to this. If you are not, then you are just a clueless blow-hard moron and don't deserve to be in your position..
---- Booth was a patriot ----
TFA says that you need to run a malicious app that intentionally exploits that system. They tested multiple android devices (and I'm assuming different versions of the OS). Also, does this work with every VPN service (like Cisco AnyConnect), or only the native system?
Would it be possible to test if any existing Play store app accidentally/intentionally triggers this exploit? I (like many Android users) don't pirate apps (even though my phone is rooted), but if the popular Play store apps are compromised, that would be a big deal for me.
Or, just don't depend on the embedded Android VPN and move to a MicroVPN that does not use the Native VPN client. Citrix Netscaler and other SSL VPN venders offer this and it has much better battery life and device performance in general since you are not using a fat client app.
Or, just don't depend on the embedded Android VPN and move to a MicroVPN that does not use the Native VPN client. Citrix Netscaler and other SSL VPN venders offer this and it has much better battery life and device performance in general since you are not using a fat client app.
using POT (Personal Open Terminal) should not skew the results?
This isn't a vulnerability at all. Apps can choose to ignore the default routing. Same on many operating systems. Windows and Linux, for example.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Good thing I don't use a VPN on my android phone! I might have been exposing my data!
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Although a bit flippant, the parent does have a point. Most older Android devices will never see a security update or fix for this issue. It is what it is, and unless that changes, a valid response it to require a minimum level of OS on the device. This is one area where Apple excels and Android does not.
If you are competent enough to use MDM on your mobile devices then your end users wouldn't be installing non-approved apps anyway
Bullshit Apple at least has gone out of their way to make this nearly impossible. Anything you can do to remove access to the App store with any of the MDMs while the device is on the carrier network is either trivially by passed by end users, or also make doing things like installing updates for approved apps completely broken.
At best you can deny micro VPN connections and sandboxed services when unapproved apps are detected, while possibly acceptable from a security standpoint its kind of closing the barn door after the horses are out for a user perspective. They just paid $5 for their app because they "forgot company policy about not installing other apps," and now your telling them they can't use it? Does not fly well.
Then there is the little matter of the fact you can't micro VPN just anything on IOS, unless its an in house app or the app vendor is willing to make ipks available, you are SOL. Which leaves you going back to things like AnyConnect or the builtin IPSec VPN; followed shortly by the users crying about how hard it is to type their password when they need to connect, so you say will okay we can use certificate only authentication but now we need a strong password on the device, and reasonable lock screen timeout, so we know its you and not the guy who grabbed it after you left in on the seat of the bus. When you do that they really pitch a fit.
IOS devices are a disaster in terms of DLP and asset management.
Things are a tad bit better on the Android side of the house with regard to MDM, yes. I am not so sure its much better on the over all security. There seems to be lots more malware in the wild.
As far as I know from a little testing with MDM demos provided by vendors and my contacts most of them fail utterly to actually detect rooted devices. They typically look for pirate ( as in radio, not warez) app stores and root tools. They often can't tell the kernel has been modified, boot loader is unlocked, etc if minor efforts to conceal the usual tools are under taken. As Corporate MDM becomes more common the rooting community is going to start making kits that are evasive and is almost sure to succeed given the current state of MDM. To say nothing of the true malware authors out there are probably already doing.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
And is grounds for termination on the spot. Circumvention of corporate resources is frowned upon.
Sure MDM isn't *perfect* ( same as "everything is vulnerable"... ) but it goes a long way to prevent people from doing wrong things, and goes even further to help catch them doing it.
Now, that out of the way, some vendor's MDM is far better than others, sounds like you have been involved with the 'not as better' group.
---- Booth was a patriot ----
This doesn't sound like vulnerability on the encryption at all but rather Android allow modification of routing table instead. This means any existing encryption stay in tact, just rather the data is going to be re-routed out of the VPN tunnel.
-=-=-=-=-=-=-=-=-=-=-=-=-=- If picture worth a thousand words, how many megapixels is it? -=-=-=-=-=-=-=-=-=-=-=-=-=-
Many devices can update to Cyanogenmod. Mine has Android 4.2.2 as Cyanogenmod 11,without Google apps, so maybe NSA & Google access to mine is minimal.
I believe we need a new Godwin's law that kicks in the first time someone expresses their opinion by calling someone else a moron or an idiot. I sometimes run OpenVPN on my Android handset; The phone is my property, I am not an end user, and the reason I use OpenVPN is nothing to do with work. So no I do not have "MDM" and am also NOT A MORON.
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
I am a fan of full disclosure and all that, but does it have to be done on a Friday afternoon? Could you not sit on the bug for just one weekend and disclose it on Monday morning, so there is a chance that the right engineers to fix it are available?
Finally! A year of moderation! Ready for 2019?
I am going to need to update our companies VPN black list to include all android devices. End of story. Problem solution.
Why would you let them on your corporate network in the first place? Who knows what random fluffy kitty screensaver apps users have installed that are happily stealing all your stuff and sending it to the Chinese government or Russian mafia?
The problem here is that i was responding to a post that was clearly related to a business environment and not in a 'consumer' environment. That you are not in that situation means your comments don't apply here, and you are taking mine out of context.
And just for the record, you are incorrect as you are an end user by definition ( which everyone is to some degree or another ), and you are also obviously a moron, with low reading comprehension skills.
Have a nice day.
---- Booth was a patriot ----
Do you have to be so insulting, derogative, condescending and patronizing?
Yes.
---- Booth was a patriot ----
It's not a security flaw, and even if it was Google could issue an update via Play to fix it for older devices. They have done just that in the past to close real holes.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
If you aren't an end user when you use the phone what are you?
Your VPN is one network interface going this way but you still have other interfaces on different IP addresses going that way and applications are free to choose which they use.
http://michaelsmith.id.au
Where did you get that it redirects all network traffic? My understanding is the venerabilty in question is about apps being able to ignore the VPN when communicateing on the public internet.
"Now the user runs the malicious app and clicks on the Exploit button which takes advantage of the vulnerability in the phone’s system"
All I see is, if you run an app on your own device then you can capture your own network traffic. If this ` malicious app ' can't get onto the device without user action then this isn't a vulnerability in Android.
The article demonstrates that it redirected unencrypted SMTP traffic out of the VPN. It's in point 4 of the steps.
Just taking a look at http://en.wikipedia.org/wiki/List_of_iOS_devices I am seeing that the oldest phone supporting the current IOS version is the 4s.
From what little I know of the apple ecosystem if such a bug was found on a iPhone 3 the effective response would be the same (you are on your own, we don't support that any more).
I agree Apple is better at this but not for any reason other than they have a much smaller list of devices to deal with.
Sounds like something they'd do for their buddies in the NSA.
You are making the false assumption that when Apple releases a new OS, they stop supporting the old. That is not the case. They continue to path them.
I found that the stock VPN on our Samsung Galaxy S4s didn't work very well with our Cisco IPsec VPN so no one bothered.
A trial version of VPNcilla I tested last week did work just fine but I guess we'll wait to see if this gets fixed first.
Pain is merely failure leaving the body
Just taking a look at http://en.wikipedia.org/wiki/List_of_iOS_devices I am seeing that the oldest phone supporting the current IOS version is the 4s.
From that page it looks like the 4 is the oldest, supporting the current iOS 7.0.4.
Well, the iPhone 3G is 6 years old at this point - around the era of the HTC G1 (Dream) as the first released Android device out there. So losing support for it isn't completely unexpected.