EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Sep 11·5 min read
Android NAT-T keepalive offload bypasses VPN lockdown
TL;DR
Android's NAT-T socket-keepalive API allows applications to bypass the Always-on VPN and Block connections without VPN settings, sending UDP packets outside the VPN. This vulnerability undermines user expectations of secure traffic management.
✦ Why It Matters
Review your app's use of NAT-T to ensure compliance with VPN security expectations.
Key Takeaways
- Ensure VPN settings are correctly configured to prevent leaks.
- Monitor network traffic for unexpected UDP packets.
- Stay informed about updates to Android security frameworks.
- Consider using additional security measures alongside VPNs.
How It Works
The vulnerability arises from the public NAT-T keepalive API, which allows applications to send UDP packets without proper validation of their permissions. When an application requests to maintain a NAT mapping, the system does not check if the application is authorized to bypass the VPN lockdown, leading to potential IP address leaks.