VPN bypass vulnerability affects Android Jelly Bean and KitKat, researchers say

The vulnerability could allow attackers to intercept traffic from Android devices despite an active VPN connection

A vulnerability in Android allows malicious applications to bypass an active VPN (virtual private network) connection and force traffic from the device through an attacker-controlled system where it can be intercepted, according to security researchers from Ben-Gurion University of the Negev in Israel.

Researchers from the university's Cyber Security Labs initially reported Jan. 17 that the vulnerability affects Android 4.3, known as Jelly Bean. However, upon further investigation they were also able to reproduce it on Android 4.4 KitKat, the latest major version of the mobile OS.

VPN technology is used to create an encrypted tunnel into a private network over the public Internet. Companies rely on VPN connections to allow employees to securely connect to corporate networks from remote locations, but it can also be used by others to protect communications from snooping when connected over insecure wireless networks since it allows accessing the Internet through the remote network's gateway.

A malicious app can exploit the newly identified Android vulnerability to bypass an active VPN connection and route all data communications from the device to a network address controlled by an attacker, the Ben-Gurion University researchers said Monday in a blog post. "These communications are captured in CLEAR TEXT (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure."

The malicious application doesn't require root privileges or VPN-specific permissions, they said Tuesday via email. Some permissions are needed, but nothing really special, they said. They declined to name the required permissions or to disclose any other technical details because it could expose the vulnerability and they are still waiting for Google to respond to their report.

The bypass works for the default VPN client included in Android and some third-party clients, but not all of them, they said, adding that they can't be more specific at the moment.

The vulnerability is related to a security issue the Ben-Gurion University researchers reported in December that they claim affects the security of Samsung KNOX, a security-hardened Android version designed to be used in enterprise environments. An app running in the nonsecure area of KNOX-based devices can exploit the issue to make network configuration changes that could allow attackers to intercept communications originating from the secure area, the researchers said at the time.

According to Samsung, the exploit uses legitimate Android network functions in an unintended way. The research does not demonstrate a vulnerability in Android or KNOX, but a classic man-in-the-middle (MitM) attack that occurs at any point on the network and can be mitigated by using VPN solutions or secure data transport protocols like SSL, the company said in a blog post Jan. 9.

Samsung's response prompted the researchers to investigate the issue further and led to the discovery of the VPN bypass.

"In the first finding we reported to Samsung the vulnerability details and an example exploit where an attacker can intercept, block, and alter data communications (non SSL/TLS and non VPN)," the researchers said in a blog post about the issue last Thursday. "We also stressed the point that other kind of attacks can take place via the same vulnerability. In our continued investigation of the vulnerability we found that an attacker can, in fact, do much more harm."

However, while the vulnerability can be used to bypass VPN connections, it cannot be used to inspect traffic that was already encrypted at the application layer.

For example, if an Android email app connects to an email server using SSL, its traffic will be encrypted regardless of whether it passes over a VPN connection or not. The same is true for connections to HTTPS-enabled websites or connections using other secure data transport protocols.

Unfortunately not all applications encrypt their traffic, so there's still a lot of sensitive information that can be captured by bypassing the VPN connection and performing a MitM attack.

Google did not immediately respond to a request for comment.

Tags Googlesecuritymobile securityencryptionExploits / vulnerabilitiesspywareBen-Gurion University of the NegevprivacyAndroid OSsamsung

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?