Examples of this include when connecting to a public Wi-Fi network or using split tunnelling features. Why does Android do this? Well, there are certain scenarios where it is necessary for an operating system to share some data. This includes some seriously compromising data, including real IP addresses, DNS lookups, HTTPS traffic, and most probably NTP traffic too. However, Mullvad’s audit has discovered that Android can still leak some user data even when this feature is enabled. There are often consequences if they are caught breaking censorship laws which can include jail time or worse. This feature is important for Android users in hostile countries where internet censorship abounds and VPNs are vital to let people access the internet freely. It is similar to the built-in kill switch that most reputable VPN providers offer these days.

This is intended to prevent accidental leaks of the user’s actual IP address in the event that their VPN connection drops out.

The crux of the issue revolves around Android’s options that allow users to block all connections unless they are connected to a VPN. The full audit has yet to be published, but Mullvad VPN has taken the fairly unusual step of going public with this issue in the hope of applying pressure on Google to do something about it. The security issue with Android has come to light as a part of a security audit carried out by VPN provider Mullvad VPN.

Mullvad VPN’s security audit casts light on Android security issues

But astonishingly, a Google engineer has responded, saying the system was deliberately designed this way, and they have no intention of fixing it. The issue has been put to Google along with a proposed solution. If that wasn’t bad enough, it also found that the leaks even happened when a user enables the Block connections without VPN or Always-on VPN features too. An independent security audit has revealed the troubling news that Android is leaking user data every time an Android device connects to a Wi-Fi network when using a VPN.

Mullvad for android