I'm sure you all know the basics about VPN services at this point
These glorified proxy servers that almost every online influencer under the sun gets
paid to shill. Now in theory VPN services are great for user privacy at least when they work because they
hide your real IP address and your location when you're connecting to all these online
services which are often times run by big tech companies that make billions of dollars
off of tracking your behavior across the web and selling that data to advertisers
But there's a lot of problems with the current state of VPNs in this economy
Most of them are not much different than Google and Facebook and the rest of big tech themselves
that created all of these free services that track you and turn you into the product except
on top of tracking and selling your data just like big tech they're charging you up front
to use the VPN service a lot of the time. So they're getting paid on both ends of the transaction
And you know sometimes the VPN service doesn't even fulfill its fundamental purpose of hiding
your IP address and your location from anybody that might be snooping on your online activity
You see the vast majority of VPN apps and configurations have some kind of leaks
Now these leaks could be caused by issues with the VPN application itself
It could be because of sloppy coding or purposefully sloppy coding for all kinds of nefarious purposes
or as we're going to see today it could be flaws outside of the VPN's control inside of the operating system
So I stumbled upon this blog post today that was written by Mulvan which in my opinion is the most
privacy focused VPN provider in existence today. Like if you're really looking for a VPN for critical privacy purposes and not just for changing
your location to outside of the US to keep using TikTok then these guys are for you
But anyway this blog post here is about DNS leaks that occur outside the VPN tunnel on Android
And let me be clear this isn't just an issue with Mulvan VPN
It's an Android issue and so therefore it's going to be an issue with every other VPN out there at least in certain
circumstances because it's specifically an issue or at least so far from the investigation
The leak seems to be limited to calls to the get adder info function
Now this is just one of the APIs on Android that are able to make DNS queries
Another one the DNS resolver API does not appear to have this problem
So if you're developing apps for Android you're probably going to want to use this instead of get adder info whenever possible
Now unfortunately as Mulvan explains here the Chrome browser does use the get adder info function
So the most popular browser in the world leaks DNS queries even when you're using a VPN
Who would have guessed that Google's browser the same browser that spies on you in incognito mode continues to function like spyware
So because of this it's pretty safe to say that a good deal of people that are using VPNs on Android are effectively wasting their money
because you know your VPN app even if you're using one like Mulvan that tries to be effective just isn't going to work because of sloppy
Android code. Now Mulvan did include some scripts here that you can use to test if your device is vulnerable to DNS leaks
And even though we're talking about problems in Android here and I've only tested it so far on an Android platform you could probably use this
on any platform that at least supports wire guard because these are wire guard configuration files
So yeah you basically just import those into wire guard and then you run this spam get request dot html which is just some JavaScript that
spams get request every 30 milliseconds. And then yeah you're able to do that test and then you can also on your router if you're running open word like me you can just SSH into it
and install the TCP dump package to it in order to monitor device traffic right on your router and then you can observe for DNS leaks like
they're showing you here. But if your router doesn't support that then you could do packet capturing with another device that's running wire shark and you could either
have the device connected right to your router or you could just capture packets out of the air if we're talking about an Android device or I
guess any device that's using Wi-Fi as long as the device that you're using to do the packet capturing has the right kind of Wi-Fi card
All right. So I'm going to go ahead and demonstrate to you guys that this leak does in fact exist on Android
So over here on the left hand side is just my open word admin panel
I just have this open to show you guys the local IPV4 address of my pixel 6 pro the device that I'm going to be testing this with
And over here on the right hand side is my terminal where I'm SSH into the same open word router
And I've already got the TCP dump command installed onto it. And this is the specific command
So TCP dump or monitoring the B.R. LAN interface. We're capturing UDP packets specifically and of course we're listening for the pixel 6 pro specifically
And by the way this apparently affects all builds of Android so it really shouldn't matter what Android device you use to test this with
Doesn't have to be a pixel. And we're also listening for port 53 specifically since it's a DNS leak that this has
Now on your Android device you want to download those two wire guard configuration files in the spam get request dot html from MulVad
I'll have a link to their blog in the description below where you can download all that stuff
And then in the wire guard app which you also have to install onto your phone
And this is just the standard wire guard application. So like anything that's using wire guard should be affected by this as well
So maybe you technically don't have to use wire guard but this is just to demonstrate that like it affects any VPN that's using this kind of configuration
So we're going to toggle on the WG1 and then in the settings we're going to toggle the always on VPN setting and block connections without VPN
And as it tells us right here when this setting is on you won't have an internet connection until the VPN successfully connects
So this is supposed to be essentially a VPN kill switch. So we've got that set
Now we'll start our packet capturing. And so if everything's working correctly which we know it's not but you'll see that it's not soon
Nothing should show up here that's not connecting to MulVad. And now we'll open up spam get request dot html with Chrome
And they tell you to do the split screen thing but this script should be able to just run in the background with Chrome
So you don't necessarily have to do this if you don't want but I will because it'll look good on video
So start that script. And then we should be able to just switch between these different configurations or you know just turn them on or off
And then you'll start seeing the request popping up. I'll actually make this bigger
And let's see if we get any leaks so far. Might take a little while to notice some
Let's see
All right. So here's one. Everything where it's connecting to MulVad test is what it's supposed to be doing
But here we just got a request to beacons dot gv2 dot com which I'm pretty sure is Google
We'll just verify that real quick. Because you know this is kind of who we're trying to avoid connecting to right
Let's see. Yeah. So this is Google. So yeah it's the VPN is not working as expected
And again we've got always on VPN and block connections without the VPN
So this should not be happening. Now let's talk about some ways to defend against this
Because like I mentioned earlier the issue appears to be narrowed down to the get adder
info function. So if whatever apps you're using on your phone don't use that function then you should be good
But the better solution here would be a VPN kill switch which could be either software
running on the device or a dedicated firewall that's running on your router or it could be a
device between your phone and the router that might be even better
You could even do a like layer to you know transparent firewall and that's going to also
make sure that there's no hop between it and make sure that no app basically no applications
are really going to be able to see that the firewall is there
Now when we're talking about VPN kill switches like I said this block connections without
the VPN is supposed to be a VPN kill switch. But as you saw it doesn't work all the time
So really my advice until Android is patched is to just not use it for anything that's sensitive
If your threat model requires a constant VPN connection and no DNS leaks no leaks of any
kind then you just shouldn't be using Android anymore unless you can put a trusty firewall
between your Android device and your router. But that's it for this video guys
If you enjoyed it please like and share it to hack the algorithm and check out my online
store based on when where you can get stylus merch like the little Damon hoodie the come
and find a T-shirt or the tie dye torti as well as accessories for your phone and laptop
and save 10 percent automatically at checkout by paying in Monero XMR
Have a great rest of your day