Tor VPN Beta: What we've learned building our own VPN for Android from scratch
29 points by confusedalex
29 points by confusedalex
Perhaps a good warning/reminder to anyone using Android for their VPN is that the Android VPN system implementations are leaky/insecure. For the level of security TOR typically tries to promise (which I'd consider above a regular VPN due to its intended use being explicitly to help people trapped in dangerous environments and people living under oppressive regimes), these are much greater showstoppers than they'd ordinarily be.
Specifically, the C getaddrinfo function bypasses the VPN entirely to do a DNS lookup if the VPN is inactive, ignoring Killswitch settings. Checking the Android issue tracker attached to that post indicates that Google doesn't seem to have fixed the bug.
By the same token, the request that's used to verify whether or not a device is connected to a network bypasses VPNs entirely, and Google doesn't consider this to be a security bug. It's only possible to fix/bypass this with an adb command.
These sorts of bugs are weirdly persistent with the Android VPN service too; earlier this year, it was discovered you could leak the IP address by asking system_server to process a constructed UDP packet. Google also didn't consider this to be a security bug. (And once again it can be mitigated with an adb command.)
I wouldn't advise anyone to that needs to Tor to use it on Android if they want to be properly anonymized, I'll say that much.
GrapheneOS is working on plugging these kinds of holes, from what I understand. All the things you mentioned have been fixed or addressed (the "connectivity checks bypass VPN" thing was deemed a non-issue for reasons which I agree with and connectivity checks can be disabled on GrapheneOS if you're worried about it).
They admit that there are still VPN leak issues. Though probably all involving a malicious app if I had to guess. Which is a lot less concerning than a leak that can just happen randomly.
How do we mitigate these issues with adb?
It's in both blogposts; you can disable the conncheck with this command:
adb shell settings put global captive_portal_mode 0
(Note that it'll cause your phone to not show authentication windows when connecting to a wifi hotspot.)
And this command should mitigate Tiny UDP Cannon:
adb shell device_config put tethering close_quic_connection -1