Source: iMore
What you need to know
- There appears to be a bug affecting VPN security on iOS.
- It was discoverd by ProtonVPN in iOS 13.3.1 or later.
- The issue could lead to a user's data or IP address being leaked.
A report from Bleeping Computer claims that there's an unpatched vulnerability in iOS VPN security that could lead to user data or IP addresses being leaked.
According to the report:
A currently unpatched security vulnerability affecting iOS 13.3.1 or later prevents virtual private networks (VPNs) from encrypting all traffic and can lead to some Internet connections bypassing VPN encryption to expose users' data or leak their IP addresses.
While connections made after connecting to a VPN on your iOS device are not affected by this bug, all previously established connections will remain outside the VPN's secure tunnel as ProtonVPN disclosed.
This VPN bypass vulnerability (rated with a 5.3 CVSS v3.1 base score) was discovered by a security consultant part of the Proton community and was disclosed by ProtonVPN to make users and other VPN providers aware of the issue.
Apparently, iOS is not terminating all existing internet connection when the user connects to a VPN. These connections are automatically reestablished after the VPN tunnel is set up. According to finder Proton VPN:
"Most connections are short-lived and will eventually be re-established through the VPN tunnel on their own... However, some are long-lasting and can remain open for minutes to hours outside the VPN tunnel."
According to the findings, user data could be exposed to third parties, or your IP address could be leaked, potentially revealing your location or exposing both the user and destination servers to attacks.
ProtonVPN has shared the findings with Apple, which has acknowledged the problem and "is currently looking into options on how to fully mitigate it." In the meantime, it's recommended that users use 'Always-on VPN' to avoid the issue, however, this does not work for third-party VPNs.
For third-party VPNs they recommend the following:
- Connect to a VPN server.
- Turn on airplane mode. This will kill all Internet connections and temporarily disconnect the VPN.
- Turn off airplane mode. The VPN will reconnect, and your other connections should also reconnect inside the VPN tunnel (not 100% reliable)
We test and review VPN services in the context of legal recreational uses. For example:
1. Accessing a service from another country (subject to the terms and conditions of that service).
2. Protecting your online security and strengthening your online privacy when abroad.
We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Welcome to iPhone 13 Pro (maybe)
Apple is likely to announce a new round of iPhones later this year – will one look like this?

Stunning new 2021 iMac leak reveals new design in five colors
Jon Prosser at Front Page Tech has just revealed that Apple plans to unveil brand new iMacs with a total redesign and in five new colors.

Project Triangle Strategy offers small but unique takes on the RPG genre
Square Enix's latest strategy RPG project is coming to Nintendo Switch in 2022, but you don't have to wait that long to try it out. You can download the demo right now. Here's what we think of this new IP.

Protect your iPhone 12 Pro through any adventure with a rugged case
If you work hard and play hard, you need a rugged case for your iPhone 12 Pro that will keep it safe during any type of adventure. We've got the heavy-duty cases you need to support a heavy-duty lifestyle.