91% of Android 12+ Devices Exposed to VPN Bypass
A vulnerability in Android's NAT-T keepalive offload allows normal apps to bypass VPN lockdown, affecting 91.24% of estimated Android-derived shipments, potentially exposing user traffic to physical routers outside the VPN path
A significant vulnerability has been discovered in Android's NAT-T keepalive offload, allowing normal applications to bypass VPN lockdown on most Android 12+ devices. This issue affects an estimated 91.24% of Android-derived shipments, potentially exposing user traffic to physical routers outside the VPN path.
The vulnerability exploits Android's public NAT-T socket-keepalive API, which can be used by normal applications to violate the VPN boundary. This is despite the 'Always-on VPN' and 'Block connections without VPN' settings, which create a user-visible expectation that traffic from covered applications will not leave through a non-VPN path.
The issue was confirmed on three OEMs: Pixel 8 Pro, Samsung SM-F966B, and Nothing A059 (Asteroids). The vulnerability is caused by a collapsed trust model in the startNattKeepaliveWithFd(...) function, which no longer authenticates the fd/resource pair or enforces the original caller UID's current VPN policy before offload.
A study of 4,679 distinct stored Git origins found no Android framework IPsec, IKE, or NAT-T API use. A manual audit also found 73 Android VpnService apps. However, the remaining 8.76% of Android-derived shipments are unresolved, leaving some devices potentially vulnerable.
## Why it matters The VPN lockdown is designed to govern routing and confinement in addition to encryption, ensuring that covered applications fail closed when the VPN is unavailable and withhold their real network identity. The bypass vulnerability undermines this security measure, potentially exposing user traffic to physical routers outside the VPN path. This could have significant implications for users and administrators who rely on VPNs to protect their online activity.
The vulnerability highlights the importance of robust security measures in mobile devices, particularly when it comes to VPNs. As more users rely on mobile devices for sensitive activities, the need for secure and reliable VPN connections has never been greater. The discovery of this vulnerability serves as a reminder of the ongoing challenges in ensuring the security and integrity of mobile devices.
