iPhone Urgent - Am I being Monitored?

[1Icarus2]

Hey everyone,

I am on iOS 13.0 since it's release and is currently Jailbroken using Unc0ver. I discovered something very interesting yesterday using the "Net Analyzer" app. It shows that there is some sort of VPN connected from my Phone. When looking in Settings under VPN in iOS, there is no VPN currently connected.

Does anyone else have this? I'm becoming a bit paranoid and worried that Net Analyzer is showing that there is a VPN network on my iPhone that I know nothing about.

When I reboot the phone, basically taking it "out" of it's Jailbreak status, the VPN is still there. So I don't know if tweaks can embed themselves into the OS even if it's "out" of JB status.

I have also put my phone into Airplane mode, and still it stays connected... It makes me think that there might be some sort of "internal" network VPN or something...

Any advice?

 

[chucker23n1]

It's probably just the network assigned by your cellular provider, incorrectly tagged as a "VPN".

Try a different network info app and see if it shows the same IP address.

 

[1Icarus2]

Hi @chucker23n1, thanks for the response.

So I downloaded 2 additional Apps:

• Network
• Joe's Network Utility

In Network, it only shows my 2 current connections, WiFi and Cellular, however on Joe's Network Utility, it shows a bit more information and still does show that VPN connection.

 

[out.of.order]

It is not for using WiFi calling???
I see that you have connected VoWiFi
[automerge]1589673990[/automerge]
Put in WiFi at home mode only or just test with Vodacom data.
WiFi calling you can turn off in settings.

 

[1Icarus2]

Hey @out.of.order,

I think you might be right, but I discovered something new yesterday.

After making this post, I decided to do a bit of tcpdump tracing on my phone. I discovered that the IP address was logging my actions on my iPhone, e.g. opening of apps, closing it, what certificates are being registered etc.

I couldn't find any solid evidence that anything from my phone is being transmitted, like Photos, Videos or Emails, so I decided to just let this go.

Last night, I discovered something EXTREMELY FREAKY!

When I opened the NetAnalyzer again, I saw that the IP address have changed, this time to a Public IP address. I completely freaked the F out and immediately started investigating.

After doing some research on the Public IP, which is 26.3.211.157, the WhoIs details states that this IP belongs to the DoD Network Information Center.

This is what the DoD does:
The Defense Information Systems Agency is a combat support agency responsible for planning, developing, fielding, operating, and supporting command, control, communications, and information systems that serve the needs of the President, Vice President, the Secretary of Defense, the Joint Chiefs of Staff, the Combatant Commanders, and the other Department of Defense (DoD) Components under all conditions of peace and war.

So initially what @chucker23n1 said, was correct. My Service Provider, Vodacom, is the one to blame here! When I remove the Sim Card, the VPN disconnects immediately. It could be the WiFi Calling, but why on earth would my Provider connect to an IP address in the USA for this? I live in South Africa!

I am going to be making some phone calls to friends today that also has Vodacom. If they have the same situation as me, I will move to another provider.

 

[1Icarus2]

So after buying another Sim Card from another provider, my phone is still doing it. Doesn't seem like it's the provider.

I'm busy preparing my phone for a complete wipe! I'll keep everyone updated.

 

[1Icarus2]

I.... give.... up!

So, new Sim Card, completely DFU restored and STILL the VPN connection is there...

Anyone have suggestions?

 

[Pangu103]

The issue lies with your provider.

 

[Enjoylife1788]

I am sure its the provider. Try a friends sim from another provider and see whether it happens.

 

[ami smith]

There is a website where you check if your employer installed employee monitoring software on your computer; www.amibeingmonitored.com. Just copy paste your task manager output and it detects potential employee monitoring software.

 

[Tiem]

So nobody has pointed this out but that is an internal, non-routable IP. 10.X, 172.X, 192.X, are all common private C class addresses.