3

A few non-rooted (no rooted) Android 7 and 8 phones from (Huawei, ZTE, Neffos and Samsung) were tested in this simple firewall (NetGuard) experiment. A selection of apps (including apps from the phone manufacturer) was chosen to be blocked from accessing the Internet regardless using Mobile Data or WiFi, by using NetGuard.

Before the experiment, NetGuard and GlassWire for Android were installed. The GlassWire is activated to monitor if these apps still can access to the Internet. Throughout the experiment, GlassWire reported that some apps, that were blocked by NetGuard, had network traffic to the Internet.

Therefore, it seems that users who buy any Android phones are denied full control of the phone, even if they have installed privacy protection apps such as NetGuard. So, to make the experiment fair enough, this question is posted here, requesting help from experts out there, on whether what is the actual problem(s).

Is the problem caused because GlassWire reports false positives? Or NetGuard requires special configurations in order to block Internet for selected apps? Or Android phones disregard users and allow apps to access Internet even though NetGuard was installed?

1
  • 1
    Could we get some screenshots of the setup for both apps? Also perhaps some packets captured would be nice to see what kind of data is being sent (not sure if your app GlassWire does this or if you need to set up some kind of mitm proxy).
    – trishmapow
    Commented Jan 22, 2019 at 10:47

1 Answer 1

3

Is the problem caused because GlassWire reports false positives?

You are correct. This question appears to be related to the understanding of OSI Model. NetGuard is based on VPN which makes use of the TUN interface at OSI layer 3, while GlassWire collects data from NetworkStatsManagr which is something within Android's Java runtime e.g. the creation of sockets happens at top layers; Application or Transport. And the UID-based data usage is collected from qtaguid module of iptables which also operates at OSI layers above 3.

Making use of Per-app VPN configuration, NetGuard asks the OS to only send traffic from app XYZ through the TUN interface so that it can be forwarded through a VPN connection (which it never does). When we see apps from the top, it looks like the apps are sending network data which is moving out of the device, but in actuality, it's blocked at layer 3. So IP packets even don't hit the physical layer.

This fact is self-explained by the GlassWire app. It has a built-in firewall which is also based on VPN; no other possible way for non-root apps. When turning on this firewall, it warns that users will still get data usage stats for the blocked app. The reason is as stated above, data is measured on upper OSI layers, and blocking occurs at a lower level:

That's why sniffers work at OSI layer 2, or even better is to watch from outside e.g. using a proxy server or at the router.

Therefore, it seems that users who buy any Android phones are denied full control of the phone, even if they have installed privacy protection apps such as NetGuard.

Well, NetGuard and similar apps have become somewhat privacy protections apps just as a side effect of Android's VPNService API which wasn't intended for this usage. Such apps can do app filtering based on UIDs and/or SOcket_MARKs which Android uses to categorize the network traffic for different purposes. If they wanted to give users freedom of choosing which apps can access the internet and which can't, they could simply set Protection Level of android.permission.INTERNET dangerous, which doesn't favor their business model; consider the fact that Google is the biggest search engine and ads are their prime source of revenue.

Advanced users who want more fine-grained control of privacy usually root their devices and make use of lower-level things like Linux kernel's built-in firewall iptables. Also, some custom ROMs have such features built-in.

RELATED:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .