Two years on, Apple iOS VPNs still leak IP addresses

Apple has left a VPN bypass vulnerability in iOS unfixed for at least two years, leaving identifying IP traffic data exposed, and there's no sign of a fix.

Back in early 2020, secure mail provider ProtonVPN reported a flaw in Apple’s iOS version 13.3.1 that prevented VPNs from encrypting all traffic. The issue was that the operating system failed to close existing connections.

This could potentially allow an attacker to identify a VPN user's source IP address. For those actually relying on hiding that data to avoid attention from a repressive regime or someone seeking private information, this is not a trivial concern.

ProtonMail at the time said Apple was aware of the issue and that Cupertino was looking at mitigation options. Apple has a workaround for enterprise users with company-managed devices, an Always On VPN. But that's not an option for consumers or others with self-managed devices.

ProtonMail revised its March 25, 2020 post every few months to note that subsequent iOS versions 13.4, 13.5, 13.6, 13.7 and 14 all left the vulnerability unfixed. The company's last update is dated October 19, 2020.

Earlier this year, Michael Horowitz, a veteran software developer and consultant, revisited the situation and found that VPNs on iOS are still vulnerable and leaking data.

"VPNs on iOS are broken," he wrote in an August 5 update to a May 25 post titled "VPNs on iOS are a scam." "At first, they appear to work fine. The iOS device gets a new public IP address and new DNS servers. Data is sent to the VPN server."

"But, over time, a detailed inspection of data leaving the iOS device shows that the VPN tunnel leaks. Data leaves the iOS device outside of the VPN tunnel. This is not a classic/legacy DNS leak, it is a data leak."

His post includes router log data that demonstrates the data leakage.

Then ten days ago, Horowitz updated his post to confirm that iOS 15.6 – Apple's latest iOS release if you don't count the 15.6.1 update that went out yesterday to patch two zero-day bugs – is still vulnerable.

Dead silence

The Register asked Apple to comment and the company has not responded, which is not completely expected.

Apple's long-standing resistance to engaging with the public, the press, and security community, to respond openly to concerns, and to provide status updates about outstanding issues allows issues like this to fester - until the public clamor grows so loud it cannot be ignored. It's the same bunker-mentality communications policy that allowed the company to formulate a CSAM scanning plan for iCloud that blew up in its face once the public got wind of the idea.