VPN bypass vulnerability affects Android Jelly Bean and KitKat, researchers say

The vulnerability could allow attackers to intercept traffic from Android devices despite an active VPN connection

A vulnerability in Android allows malicious applications to bypass an active VPN (virtual private network) connection and force traffic from the device through an attacker-controlled system where it can be intercepted, according to security researchers from Ben-Gurion University of the Negev in Israel.

Researchers from the university's Cyber Security Labs initially reported Jan. 17 that the vulnerability affects Android 4.3, known as Jelly Bean. However, upon further investigation they were also able to reproduce it on Android 4.4 KitKat, the latest major version of the mobile OS.

VPN technology is used to create an encrypted tunnel into a private network over the public Internet. Companies rely on VPN connections to allow employees to securely connect to corporate networks from remote locations, but it can also be used by others to protect communications from snooping when connected over insecure wireless networks since it allows accessing the Internet through the remote network's gateway.

A malicious app can exploit the newly identified Android vulnerability to bypass an active VPN connection and route all data communications from the device to a network address controlled by an attacker, the Ben-Gurion University researchers said Monday in a blog post. "These communications are captured in CLEAR TEXT (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure."

The malicious application doesn't require root privileges or VPN-specific permissions, they said Tuesday via email. Some permissions are needed, but nothing really special, they said. They declined to name the required permissions or to disclose any other technical details because it could expose the vulnerability and they are still waiting for Google to respond to their report.

The bypass works for the default VPN client included in Android and some third-party clients, but not all of them, they said, adding that they can't be more specific at the moment.

The vulnerability is related to a security issue the Ben-Gurion University researchers reported in December that they claim affects the security of Samsung KNOX, a security-hardened Android version designed to be used in enterprise environments. An app running in the nonsecure area of KNOX-based devices can exploit the issue to make network configuration changes that could allow attackers to intercept communications originating from the secure area, the researchers said at the time.

According to Samsung, the exploit uses legitimate Android network functions in an unintended way. The research does not demonstrate a vulnerability in Android or KNOX, but a classic man-in-the-middle (MitM) attack that occurs at any point on the network and can be mitigated by using VPN solutions or secure data transport protocols like SSL, the company said in a blog post Jan. 9.

Samsung's response prompted the researchers to investigate the issue further and led to the discovery of the VPN bypass.

"In the first finding we reported to Samsung the vulnerability details and an example exploit where an attacker can intercept, block, and alter data communications (non SSL/TLS and non VPN)," the researchers said in a blog post about the issue last Thursday. "We also stressed the point that other kind of attacks can take place via the same vulnerability. In our continued investigation of the vulnerability we found that an attacker can, in fact, do much more harm."

However, while the vulnerability can be used to bypass VPN connections, it cannot be used to inspect traffic that was already encrypted at the application layer.

For example, if an Android email app connects to an email server using SSL, its traffic will be encrypted regardless of whether it passes over a VPN connection or not. The same is true for connections to HTTPS-enabled websites or connections using other secure data transport protocols.

Unfortunately not all applications encrypt their traffic, so there's still a lot of sensitive information that can be captured by bypassing the VPN connection and performing a MitM attack.

Google did not immediately respond to a request for comment.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacymobile securityGooglespywaresamsungExploits / vulnerabilitiesAndroid OSBen-Gurion University of the Negev

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?