VPN Encryption Vulnerability On Android 77
An anonymous reader writes "Cyber security labs at Ben Gurion University have uncovered a network vulnerability on Android devices which has serious implications for users of VPNs. This vulnerability enables malicious apps to bypass active VPN configuration (no root permissions required) and redirect secure data communications to a different network address. These communications are captured in clear text (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure."
Re:black listing all androids in 5..4..3..2..1 (Score:5, Insightful)
Better blacklist windows, apple, blackberry, desktops, laptops.... Everything is vulnerable. Even your users. Its how you mitigate the ongoing risk that separates the men from the boys.
If you are competent enough to use MDM on your mobile devices then your end users wouldn't be installing non-approved apps anyway so they would be at minimal risk of exposure to this. If you are not, then you are just a clueless blow-hard moron and don't deserve to be in your position..
Actively run the exploit... (Score:4, Insightful)
TFA says that you need to run a malicious app that intentionally exploits that system. They tested multiple android devices (and I'm assuming different versions of the OS). Also, does this work with every VPN service (like Cisco AnyConnect), or only the native system?
Would it be possible to test if any existing Play store app accidentally/intentionally triggers this exploit? I (like many Android users) don't pirate apps (even though my phone is rooted), but if the popular Play store apps are compromised, that would be a big deal for me.
Re:black listing all androids in 5..4..3..2..1 (Score:4, Insightful)
Although a bit flippant, the parent does have a point. Most older Android devices will never see a security update or fix for this issue. It is what it is, and unless that changes, a valid response it to require a minimum level of OS on the device. This is one area where Apple excels and Android does not.
Re:black listing all androids in 5..4..3..2..1 (Score:3, Insightful)
I am going to need to update our companies VPN black list to include all android devices. End of story. Problem solution.
Why would you let them on your corporate network in the first place? Who knows what random fluffy kitty screensaver apps users have installed that are happily stealing all your stuff and sending it to the Chinese government or Russian mafia?