VPN bypass vulnerability affects Android ‘Jelly Bean’ and ‘KitKat’

A vulnerability in Android allows malicious applications to bypass an active VPN (virtual private network) connection and force traffic from the device through an attacker-controlled system where it can be intercepted, according to security researchers from Ben-Gurion University of the Negev in Israel.

Researchers from the university’s Cyber Security Labs initially reported Jan. 17 that the vulnerability affects Android 4.3, known as Jelly Bean. However, upon further investigation they were also able to reproduce it on Android 4.4 KitKat, the latest major version of the mobile OS.

[ Learn how to secure your systems with the Web Browser Deep Dive PDF special report and Security Central newsletter, both from InfoWorld. ]

VPN technology is used to create an encrypted tunnel into a private network over the public Internet. Companies rely on VPN connections to allow employees to securely connect to corporate networks from remote locations, but it can also be used by others to protect communications from snooping when connected over insecure wireless networks since it allows accessing the Internet through the remote network’s gateway.

A malicious app can exploit the newly identified Android vulnerability to bypass an active VPN connection and route all data communications from the device to a network address controlled by an attacker, the Ben-Gurion University researchers said Monday in a blog post. “These communications are captured in CLEAR TEXT (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure.”

The malicious application doesn’t require root privileges or VPN-specific permissions, they said Tuesday via email. Some permissions are needed, but nothing really special, they said. They declined to name the required permissions or to disclose any other technical details because it could expose the vulnerability and they are still waiting for Google to respond to their report.

The bypass works for the default VPN client included in Android and some third-party clients, but not all of them, they said, adding that they can’t be more specific at the moment.

The vulnerability is related to a security issue the Ben-Gurion University researchers reported in December that they claim affects the security of Samsung KNOX, a security-hardened Android version designed to be used in enterprise environments. An app running in the nonsecure area of KNOX-based devices can exploit the issue to make network configuration changes that could allow attackers to intercept communications originating from the secure area, the researchers said at the time.

According to Samsung, the exploit uses legitimate Android network functions in an unintended way. The research does not demonstrate a vulnerability in Android or KNOX, but a classic man-in-the-middle (MitM) attack that occurs at any point on the network and can be mitigated by using VPN solutions or secure data transport protocols like SSL, the company said in a blog post Jan. 9.

Samsung’s response prompted the researchers to investigate the issue further and led to the discovery of the VPN bypass.

“In the first finding we reported to Samsung the vulnerability details and an example exploit where an attacker can intercept, block, and alter data communications (non SSL/TLS and non VPN),” the researchers said in a blog post about the issue last Thursday. “We also stressed the point that other kind of attacks can take place via the same vulnerability. In our continued investigation of the vulnerability we found that an attacker can, in fact, do much more harm.”

However, while the vulnerability can be used to bypass VPN connections, it cannot be used to inspect traffic that was already encrypted at the application layer.

For example, if an Android email app connects to an email server using SSL, its traffic will be encrypted regardless of whether it passes over a VPN connection or not. The same is true for connections to HTTPS-enabled websites or connections using other secure data transport protocols.

Unfortunately not all applications encrypt their traffic, so there’s still a lot of sensitive information that can be captured by bypassing the VPN connection and performing a MitM attack.

Google did not immediately respond to a request for comment.