per-app-split-bypass-poc - GitLite

KO | EN

gitlite — search

#python #react #ai #llm #machine-learning #rust #deep-learning #macos #windows #cli #kubernetes #awesome-list #openai #open-source

per-app-split-bypass-poc

(★ 241)

No description available.

File Explorer

Download Latest Version (.zip)

- - android-release.yml
- .gitignore
- build.gradle.kts
- proguard-rules.pro
- - preview.png
- - gradle-wrapper.jar
  - gradle-wrapper.properties
- gradle-daemon-jvm.properties
- libs.versions.toml
- .gitignore
- build.gradle.kts
.gitignore
build.gradle.kts
gradle.properties
gradlew
gradlew.bat
README.md
settings.gradle.kts

# Installation Guide

1. Get the code

git clone https://github.com/runetfreedom/per-app-split-bypass-poc

Downloads the entire project code from GitHub to your computer.

cd per-app-split-bypass-poc

Moves into the project folder you just downloaded.

2. Gradle (Java/Kotlin)

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
JDK (Java) Required to build and run Java/Kotlin projects.
Gradle If the repo includes gradlew (Gradle Wrapper), you don't need to install Gradle separately.

cd app

This project's files live in a subfolder, so move into it first.

./gradlew build

Builds the project using Gradle.

✅ A BUILD SUCCESSFUL message means it worked. The output is created under build/.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Private space and per-app split tunneling bypass POC

![](https://github.com/runetfreedom/per-app-split-bypass-poc/raw/master/assets/image/preview.png)

This repository is a POC for a vulnerability that should be called the "localhost attack"

Almost all mobile clients based on xray/sing-box run a local socks5 proxy without authentication.

At the same time, per-app split tunneling is implemented using VpnService, which redirects traffic to tun2socks (or something similar). But if there is spyware on the user's device (for example, as part of a government application), nothing prevents it from connecting directly to this socks5 proxy, bypassing VpnService, and discovering the user's external IP address.

The situation is complicated by the fact that Android private spaces (Knox, Shelter, Island, etc), while isolating VpnService, do not isolate the loopback interface. This means that even if the spyware is located inside a private space, it is still possible to scan all localhost ports and find the socks5 proxy. This gives the user a false sense of security.

I was prompted to research this vulnerability by the [discovery of spyware](https://habr.com/ru/articles/1006666/) in the Russian national messenger Max, which checked the success of WhatsApp and Telegram blocks, and also tried to find the external IP of the VPN service.

## Proposed solution

I propose always running the socks5 proxy with authentication. Furthermore, it should use a randomly generated login/password on each device to prevent brute-force attacks.

# Xray API

An even greater vulnerability is launching Xray with `HandlerService` enabled. In this case, an attacker can not only find out the client's external IP, but also dump the outbound configuration there. This will allow the attacker to find out the connection address, reality sni, uuid, and so on.

This vulnerability is hazardous, but fortunately, I only found one client that would do this.