A vulnerability has been discovered in iOS due to which virtual private networks (VPNs) cannot encrypt traffic, and some Internet connections completely bypass VPN encryption, revealing user data and IP addresses. The issue affects iOS version 13.3.1 and higher.
How reported experts from ProtonVPN, the vulnerability does not affect connections made after connecting to the VPN on the iOS device, however, all previously established connections will remain outside the protected VPN traffic. The problem was rated 5.3 on the CVSS v3.1 scale.
The error is due to the fact that iOS does not interrupt all existing Internet connections when the user connects to the VPN, and automatically connects them to the target servers after installing the VPN tunnel.
“Most connections are short-lived and will eventually be restored through the VPN tunnel on their own. However, some of them work for a long time and can remain open from several minutes to several hours outside the VPN tunnel, ”the experts explained.
The problem can lead to serious consequences. For example, user data may be disclosed to third parties if the connections are not encrypted, and IP address leaks can potentially reveal the location of users or put them at risk of attacks.
Apple has recognized the VPN bypass vulnerability and is currently working to fix it. The company recommends that users use Always-on VPN as a temporary solution to this problem.