There seems to be a major vulnerability in Android: even when using firewalls these aren't active immediately after a restart.

The seconds before the firewall (NetGuard) starts can be used by apps that auto-start to send (exfiltrate) all kinds of data.

For example:

How can this be prevented?

One way could be to always deactivate Internet before turning the phone off but that may not always work (for example when updating) and sometimes the phone could get turned off accidentally or because the battery goes empty.

  • 2
    Do you know the "Always-on VPN" functionality? I would assume that this was developer exactly for preventing situations when the VPN is not (yet) active. developer.android.com/guide/topics/connectivity/vpn#always-on
    – Robert
    Apr 30, 2022 at 12:17
  • Have people tested whether this is reliable and sufficient? Why don't you post this as an answer? There is no hint or option for this in NetGuard so I need to create a new issue. Because the developer failed to enable Issues on GitHub I need to ask on the XDA forums.
    – mYnDstrEAm
    Apr 30, 2022 at 13:46
  • I don't post it as an answer as I don't have any detailed knowledge on the "Always-on VPN" feature how it works internally. To my understanding it was developed e.g. for companies that want to make sure their devices only get network access through their VPN, so I would expect it to work properly but often features you read about don't work the way you imagine, therefore without personal experience or detailed knowledge on that specific feature it is IMHO not worth of an an answer.
    – Robert
    Apr 30, 2022 at 13:57
  • I asked about it on the xda-forums thread because the GitHub issues are disabled here. However, the developer doesn't seem to care. You can comment if you think this is an important vulnerability to close. Also: don't check "Block connections without VPN" in these options or else Internet may not work, this may depend on your DNS settings.
    – mYnDstrEAm
    May 9, 2022 at 21:18


You must log in to answer this question.

Browse other questions tagged .