4

I know the android VPN settings are not reliable - the VPN connection can drop, and certain system processes will ignore the VPN. So "Apps VPN Mode" sounds to me like a nice to have experimental feature for non rooted devices to get past firewalls etc.

So if I have a rooted device, and use Tor Everything (which does not make use of the Android VPN feature), can I be sure that this routes all processes through Tor? And do I still need Apps VPN Mode?

PS: Is there a situation in which if rooted Orbot can't connect to the internet but is trying, or the phone is sleeping, some other (system) app can end up making its own non-tor connection before Orbot has a chance to take over? Can a different rooted app make a non-Orbot connection without killing the Orbot service first?

  • PPS: Sometimes in my network log I see non-Orbot apps that are sending and receiving packets. Does that mean they're circumventing Tor, or is it just logged in parallel with Orbot actually taking care of those packets? – Spectraljump Feb 5 '17 at 17:50
  • For instance Google Play or VoIP apps. - But it only happens rarely. For example while downloading 30 app updates just now, I get one entry for Google Play Store (13 packets) in the network log and a ton of Orbot entries (hundreds of packets). – Spectraljump Feb 5 '17 at 17:57
4

You may be interested in reading 'Mission Impossible: Hardening Android for Security and Privacy' and it's update 'Mission Improbable: Hardening Android for Security And Privacy'.

To directly answer the question, if iptables and root access is available, then "Tor Everything" will provide a more complete means of enforcing Tor usage on the device, since it is applied from the linux kernel rather than the userspace portion of the operating system. It's acknowledged that the VPN may leak, it's there as a best effort option for people who do not have root access on their devices.

There is still a potential for leaks, since Orbot starts up along with the other apps on the system, if one of them beats it to running iptables then they will connect outside of Tor. To this end, there are further steps you can take.

OrWall performs some of the same actions that Orbot does (note: it will conflict with Orbot trying to "Tor Everything", use one or the other, not both!), it provides a more granular set of options, allowing you to set a network policy per-app, so you can deny network connectivity entirely, enforce transproxy, allow it localhost access or allow it to connect directly without Tor. It also places an "init" script into the android filesystem, which blocks outbound traffic much earlier in the boot process which stops leaks, since before any apps get to start outbound traffic is already disabled, and will only be enabled when OrWall starts later and sets up the users chosen policies.

Much of these problems also come from how fragmented the android ecosystem is, there is little to no uniformity in deployed operating system versions, kernel configuration and features and functionality provided in some of the included binary blobs. The android ecosystem is currently not really suitable for high security use outside of very specific cases with known hardware and lots of work put into it (see the Mission Improbable post and the work of the Copperhead OS team).

  • I just want to add that right now, Orbot is saying "No internet connection; Tor is on standby" while it is in "Tor Everything" mode, and while I have wifi connected and my non-tor browsers can surf the web and my google services are online. Will try Orwall. Edit: maybe the drawer notification was outdated by a few seconds though. Anyway props for the Mission links and Orwall. I hadn't discovered those. – Spectraljump Feb 6 '17 at 13:46
  • Orwall "also has an option to let a specific Voice over IP app, like Signal, bypass Tor for the UDP voice data channel, while still sending call setup information over Tor." - Omg I love this thing. – Spectraljump Feb 6 '17 at 13:56
0

none: if you use a hostapd for your own software AP and elaborate tcpdump - you'll see that on boot-up there're a leak: so use whatever you want or - for a better security - use a routing middlebox

  • Yeah. A routing middlebox means running your own router with a custom tor-enabled OS. Which is cool, but I was looking for good-enough solutions for when I'm not home. – Spectraljump Feb 6 '17 at 13:44
  • raspberry Pi or Orange Pi PC + 5V powerbank - and it's pretty portable – Alexey Vesnin Feb 6 '17 at 14:23
  • That is a good point. Reminds me of this piece of news: hackaday.io/project/19035-zerophone-a-raspberry-pi-smartphone/… I hope instead of making it into a phone they just ship it as a middlebox. – Spectraljump Feb 6 '17 at 14:27
  • 1
    no, you need a much simplier setup: a raspberryPi, but Orange is better, with a heatsink, wifi usb dongle(for your phone tethering) and another usb wifi dongle(for open wifi connection) or 3G/4G usb stick for a cell mobile data connection. It can handle all by itself + perfectly controllable from your phone via WiFi. The powerbank is just "plug and use" solution: my raspberry pi2 with 2 wifi dongles on a mid-range powerbank was working for 2+ hours and the battery was not depleted, I haven't tested more. – Alexey Vesnin Feb 6 '17 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.