In April 2024, one of our users did their own testing for VPN leaks on GrapheneOS and discovered multiple issues with the standard Android leak blocking. We’ve addressed both the network DNS leak when 3rd party VPN apps go down and apps bypassing the VPN via multicast packets.
We’ve been working on it since April 2024 and have discovered multiple other kinds of leaks. Our latest release addresses all of the known multicast packet leaks, which includes the issue they reported and also 2 more issues we discovered ourselves:
https://grapheneos.social/@GrapheneOS/113225545170043482
We initially shipped our multicast leak blocking in our 2024091700 release but it had to be rolled back due to a severe compatibility issue with IPv6-only networks. Some carriers have IPv6-only mobile data for some or all users with 464XLAT for IPv4 so it’s not an edge case.
There were several apps including KDE Connect lacking proper error handling for multicast system calls which were crashing from uncaught exceptions. These apps should be fixed but we need to be compatible with buggy apps so we still would have had to roll back our changes.
DuckDuckGo app has an “App Tracking Protection” which was going into a panic from multicast filtering and spamming enormous numbers of packets which were acting as a DDoS on routers and breaking entire local networks.
Both the IPv6 and app compatibility issues appear resolved.
The issue found by a GrapheneOS user in April 2024 was apps being able to bypass Android’s leak blocking by sending multicast packets themselves. We also found other leaks via kernel-generated packets. Our eBPF filter work addresses all of these issues:
On Android, each user or work profile has their own VPN configuration. Owner user VPN is used for privileged system processes unless they apply special rules for packets.
There are checks to only permit processes sending packets via allowed networks, but we found a hole in it.
We discovered apps can partially bypass these restrictions for VPN tunnels owned by other profiles by using multicast packets. We were unable to figure out an easy way of resolving it with eBPF so we’re using netfilter for this part of our leak blocking:
https://github.com/GrapheneOS/platform_system_netd/commit/036d9afd8c3c240fd4ae3a0d2a5059bcaf43fd91
In May 2024, we shipped strict DNS leak blocking to block both the reported leak to network DNS and also leaks to VPN DNS servers outside the tunnel:
https://github.com/GrapheneOS/platform_system_netd/commit/ab1a83dc36e17c4ec61def8cc7386f908e054add
The initial strict approach was reverted before it reached Stable due to VPN app compatibility issues.
We currently use a less strict implementation blocking all leaks to network DNS servers, which fixes what was reported in April 2024 but not everything:
https://github.com/GrapheneOS/platform_system_netd/commit/91caf5c858888cf2dc4bea854e5d3c7ceb2e507a
We’re working on a stricter approach that’s compatible with ProtonVPN, but it’s very hard to test.
There are 2 remaining holes we discovered and don’t cover yet:
- Queries to VPN DNS outside the VPN tunnel
- Android 14 inbound packet leak blocking is incomplete
We know how to block both kinds of leaks, but we need to be very careful to do it without breaking some VPN apps.
We recently hired the developer who made of our 2-factor fingerprint unlock feature that we’ll be shipping shortly after Android 15 is released. They did all of this multicast leak blocking work and are working on fully resolving the remaining 2 already partially resolved issues.
GrapheneOS currently has 6 full-time developers and 1 part-time developer. There are multiple people working as volunteers or who have applied to be hired who we want to hire. Can help us do that with more donations: https://grapheneos.org/donate. We make very good use of the money.
We’re very open to helping to get these issues fixed for all Android users. Google simply needs to start treating us fairly and realize collaboration is a 2 way street. We’ve found more severe bugs than VPN leaks. Ready to help them as soon as this stops:
https://grapheneos.social/@GrapheneOS/112916683153814021
The dates in the thread should all be fixed now. It was meant to say April 2024 and May 2024 but it got mixed up while assembling it and it wasn’t noticed until today. It’s also fixed at https://discuss.grapheneos.org/d/16161-grapheneos-fixing-the-standard-vpn-leak-blocking-is-nearing-completion/. We unfortunately can’t fix it on X and Bluesky beyond adding a reply with a correction.