Although not necessarily everyone who uses VPN (Virtual Private Network) services focuses on encrypted connections, Apple’s own iCloud Private Relay function has similar functions focused on security. How could it be so good that only its own application can skip the secure connections of other VPN services? Continue reading Research shows that most original Apple apps in iOS 16 will bypass VPNs, and even Android systems have reported this.
Research shows that most original Apple apps in iOS 16 will bypass VPNs, even Android systems
It has been pointed out by ProtonVPN in the past that in the iOS 13 era, it was discovered that Apple’s smartphone system was avoiding VPN encrypted connections. It was considered a possible bug at the time. However, as time and version numbers have come to the latest iOS 16 in 2022, security experts have recently discovered that such a problem “still” exists in the Apple system.
Security expert Michael Horowitz believes that Apple should be able to easily reproduce this situation, so he doesn’t know why this problem has not been corrected. Recently, someone else posted a video of an analysis tool on Twitter, showing that when using various original Apple apps, DNS requests can still bypass VPN encrypted connections to communicate with Apple servers.
We confirm that iOS 16 does communicate with Apple services outside an active VPN tunnel. Worse, it leaks DNS requests. #Apple services that escape the VPN connection include Health, Maps, Wallet.
We used @ProtonVPN and #Wireshark. Details in the video:#CyberSecurity #Privacy pic.twitter.com/ReUmfa67ln— Mysk 🇨🇦🇩🇪 (@mysk_co) October 12, 2022
These applications include Apple’s Maps, Health, Wallet, App Store, Find My, Settings and Files applications. And he said that he had this situation with the services of ProtonVPN and Wireshark. Interestingly, security experts have also discovered that the Android system actually has a similar situation. Even in the VPN settings on Pixel phones running Android 13, if you choose to enable and block non-VPN connections at all times, there will still be similar situations where original apps can circumvent encrypted connections.
It has to be said that since smartphone system applications basically claim to have end-to-end encryption capabilities, perhaps because of this, they are confident that they can protect users’ data security without being encrypted by such services – although it is basically difficult to avoid the suspicion that the original manufacturer has opened a backdoor…
In this regard, information security experts pointed out that since the two industry players in the system are currently extremely confident in their encryption capabilities (they should be). If you still want your connection to be fully protected under VPN protection, you may only be able to activate this type of service through a Wi-Fi router to force the connection to not be detoured.
I don’t know if you think this situation in Apple and Google’s smartphone systems is a system “bug” or is it intentional? Can you share your own insights with us?
Further reading:
Source: KOCPC Chinese