Unpatched iOS Bug Blocks VPNs From Encrypting All Traffic

Джерело:
Slashdot

Дата публікації:
27/03/2020 02:02

Постійна адреса новини:
http://www.vsinovyny.com/6600550

Unpatched iOS Bug Blocks VPNs From Encrypting All Traffic

27/03/2020 02:02 // Slashdot

An anonymous reader quotes a report from Bleeping Computer: A currently unpatched security vulnerability affecting iOS 13.3.1 or later prevents virtual private network (VPNs) from encrypting all traffic and can lead to some Internet connections bypassing VPN encryption to expose users' data or leak their IP addresses. While connections made after connecting to a VPN on your iOS device are not affected by this bug, all previously established connections will remain outside the VPN's secure tunnel as ProtonVPN disclosed. The bug is due to Apple's iOS not terminating all existing Internet connections when the user connects to a VPN and having them automatically reconnect to the destination servers after the VPN tunnel is established. "Most connections are short-lived and will eventually be re-established through the VPN tunnel on their own," ProtonVPN explains. "However, some are long-lasting and can remain open for minutes to hours outside the VPN tunnel." During the time the connections are outside of the VPN secure communication channels, this issue can lead to serious consequences. For instance, user data could be exposed to third parties if the connections are not encrypted themselves, and IP address leaks could potentially reveal the users' location or expose them and destination servers to attacks. Until Apple provides a fix, the company recommends using Always-on VPN to mitigate this problem. "However, since this workaround uses device management, it cannot be used to mitigate the vulnerability for third-party VPN apps such as ProtonVPN," the report adds.

«	Наступна новина з архіву Статья Оглавления, указатели и списки литературы в OpenOffice.org Writer	Попередня новина з архіву 'League' of Cybersecurity Professionals Band Together To Help Hospitals Fight Off Hackers	»