安卓系统又发现了一种新的流量泄漏方式。

安卓系统又发现了一种新的流量泄漏方式。
Another way to leak traffic on Android has been discovered

原始链接: https://mullvad.net/en/blog/another-way-to-leak-traffic-on-android-has-been-discovered

Android 网络协议栈中新发现的一个漏洞允许恶意应用程序绕过 VPN 通道以及“阻止无 VPN 连接”的设置。通过利用旨在用于硬件卸载 NAT 保活数据包的功能，应用程序可以在无需特殊权限的情况下直接从网络硬件发送流量，从而泄露用户的真实 IP 地址。尽管研究人员已向谷歌漏洞奖励计划报告了该缺陷，但该问题在未采取任何行动的情况下被关闭，因此系统级的修复不太可能实现。GrapheneOS 目前正在开发自己的解决方案，但对于普通 Android 用户而言，目前尚无可靠的通用缓解措施。虽然有人建议通过“填满”硬件的保活容量来阻止进一步的恶意连接，但这并不能保证修复，且仍有轻微泄露的风险。因此，最好的防御措施仍然是保持谨慎，仅安装可信的应用程序。注重隐私的用户可以考虑切换到 GrapheneOS 等专注于安全的 Android 分支版本，这些系统正在积极解决此漏洞。

原文

A newly discovered leak in Android allows any app to send traffic outside the VPN tunnel.

Yet another leak was recently discovered in the Android network stack that allows a malicious app to send traffic outside the VPN tunnel, even when "Block all connections without VPN" is active.

Having traffic leak outside the tunnel means your real IP address becomes visible on the Internet, which could potentially be used for tracking or surveillance purposes.

The malicious app does not need any special permission to perform this attack.

A proper fix would require changes in the Android system. The researcher who discovered the leak has reported the issue to the Android Vulnerability Reward Program, but according to the researcher the issue was closed without action. This issue is not public, but based on this information we deem it unlikely that Google will do anything about it. GrapheneOS is aware of the issue and are working on a fix.

Technical details

The leak involves telling Android to create a keep-alive UDP connection that is offloaded to the hardware Wi-Fi or cellular chip. The intended purpose of this connection is to help with network address translation (NAT) traversal, but a malicious app can misuse this to send UDP packets on port 4500 to any server on the Internet. As these keep-alive UDP packets are sent directly from the network hardware, they bypass the check that all traffic must go through the VPN connection when "Block all connections without VPN" is enabled, thus exposing the device's real IP address.

Mitigation

The network hardware only supports having a limited amount of keep-alive connections at the same time, so a theoretical solution could be to use some kind of application that creates its own keep-alive connection until the capacity is reached. After that any malicious app would no longer be able to create its own connection.

Mullvad does not currently have any plan to provide this theoretical mitigation ourselves as it would still involve sending packets outside to the tunnel, even though they are to a Mullvad owned server. Furthermore, such a mitigation it is not guaranteed to work, as a malicious app may have already initiated the leak before the Mullvad app is started.

Conclusion

As always, it is most important to only install trusted apps on your device, and (if possible) use a security and privacy focused Android fork like GrapheneOS.