RKNHardering

Android application for detecting VPNs and proxies on a device. Implements the methodology used by RKN (Russian federal oversight body) to identify circumvention tools.

Community Help Wanted

This project documents methods for detecting VPNs and proxies on Android devices. However, the inverse problem — how to prevent the detection of an active VPN — has been studied much less thoroughly.

Contributors are sought to help collect, organize, and test information about ways to bypass detection, including, but not limited to:

- Network interface masking (how to hide tun0, wg0, and other VPN-like interfaces from NetworkInterface.getNetworkInterfaces() and /proc/net/route) - NetworkCapabilities spoofing (ways to remove TRANSPORT_VPN, IS_VPN, and VpnTransportInfo from ConnectivityManager responses) - Hiding from dumpsys (preventing information leakage through dumpsys vpn_management and dumpsys activity services android.net.VpnService) - MTU normalization (setting a standard MTU of 1500 for tunnel interfaces across different clients) - DNS leaks (preventing detection of loopback/private DNS while a VPN is active) - Hiding localhost proxies (how to prevent detection via /proc/net/tcp and port scanning) - Bypassing native checks (countering JNI-based checks through /proc/self/maps, getifaddrs(), and dlsym) - Masking installed applications (hiding VPN app packages from PackageManager)

Those with expertise in these areas are encouraged to open an Issue or Pull Request describing the method, the conditions under which it applies, and its limitations. Any information is valuable — from theoretical ideas to working Proofs of Concept.

Architecture

Independent verification modules run in parallel. The final verdict is calculated in VerdictEngine.

IpComparisonChecker is stored in the result and shown in the UI as a diagnostic block but does not currently participate in VerdictEngine.

Verification modules include:

- GeoIpChecker — GeoIP + hosting/proxy signals - IpComparisonChecker — RU/non-RU IP checkers (diagnostic) - DirectSignsChecker — NetworkCapabilities, system proxy, installed VPN apps - IndirectSignsChecker — interfaces, routes, DNS, dumpsys, proxy-tech signals - CallTransportChecker — STUN/MTProto (leaks and availability) - CdnPullingChecker — HTTPS requests to CDN/redirector - LocationSignalsChecker — MCC/SIM/cell/Wi-Fi/BeaconDB - BypassChecker — localhost proxy, Xray gRPC API, underlying-network leak - RttTriangulationChecker — SNITCH (beta): RTT triangulation via RU/foreign hosts - NativeSignsChecker — JNI checks (routes, interfaces, hooks, root)

License

GNU Affero General Public License v3.0