3 ms·

Can a DNS server be used to fake Android/iOS internet connection tests? What I'm after is a simple smartphone connection to a local only, no fuss, wifi network

Can a DNS server be used to fake Android/iOS internet connection tests? What I'm after is a simple smartphone connection to a local only, no fuss, wifi network --- without any additional setup required.

mschuster91 3y ago
You need a DNS server and an HTTP server supporting virtual hosts. The list of domains and expected responses by different platforms are listed on Wikipedia [1]. [1] https://de.wikipedia.org/wiki/Captive_Portal https://de.wikipedia.org/wiki/Captive_Portal
- jqpabc123 3y ago
  Thank you
jeroenhd 3y ago
On Android: not really. Android's connectivity check will connect to Google.com over HTTPS to verify connectivity. You can fake DNS and redirect some apps to local servers, but you'll quickly run into issues with HTTPS connections. If you want to fake an Internet connection on Android using just DNS and HTTP, you'll probably end up bypassing some checks and failing others. Google's apps will likely all report that you don't have an internet connection and won't even try to connect, social media won't work, and other apps will get very confused but will probably still try to operate. You can work around some of these issues by becoming your own certificate authority and setting up TLS certificates for every website you need to mock, but on Android that'll be difficult to pull off in most apps. Browsers should work fine if you load up your own root certificate (though you need a special secret setting on Firefox for Android because of Mozilla reasons). For apps, you'd need to root your phone and place your root certificate in the right place on the system image (there are Magisk modules that can help you here). This will fix apps that opt out of user store certificates, but it will break Chrome, since Chrome requires certificates to be recorded in the certificate transparency logs, which you can't do. You can install the certificate in both stores to work around this issue. Most apps on either iOS or Android implement certificate pinning, which means even if you get your root certificate into the system trust store, you'll still see failed connections. You can hack those apps (for example, using Frida to patch the applications) but you'll have to do each app individually. I don't know the current status on the connectivity check on iOS, I believe you can get that to work with basic DNS and an HTTP server, but it's possible Apple has gone the HTTPS route too.
- jqpabc123 3y ago
  So basically, it's not practical to do this.
  - jeroenhd 3y ago
    I've done it to monitor my phone for weird traffic, but I wouldn't recommend it unless you're dedicated and willing to deal with janky tooling. Magisk + mitmproxy + Frida + an isolated WiFi network works pretty well for traffic monitoring. With mitmproxy you can also write scripts to fake APIs (which can help you with your attempt to fake the network connectivity status).
    - jqpabc123 3y ago
      I'm looking to allow users with stock, unmodified software stack to easily connect to a local only wifi network with minimal headaches. Magisk, etc. is not an option.
      - jeroenhd 3y ago
        What's keeping you from connecting to the WiFi? As far as I know, Android and iOS can connect to offline networks just fine. You may need to disable the "network quality" test for that particular network, but I'm pretty sure stock Android stay connected just fine.
        jqpabc123 3y ago
        It can be done --- just not easily or intuitively. To start, you have to enable "airplane mode" on your android phone. This shuts down all communication. If you don't do this your phone will try to use your wireless service for all communication. Next, you have to selectively enable wi-fi. If there are any other wireless networks in the area that you connect to automatically, you have to disable them, otherwise, your phone will connect and use one of them first. Finally, with all other communication options disabled, you can connect to and force your phone to reluctantly use the local network with no internet access.

mschuster91 3y ago

You need a DNS server and an HTTP server supporting virtual hosts. The list of domains and expected responses by different platforms are listed on Wikipedia [1]. [1] https://de.wikipedia.org/wiki/Captive_Portal https://de.wikipedia.org/wiki/Captive_Portal

jqpabc123 3y ago
Thank you

jeroenhd 3y ago

On Android: not really. Android's connectivity check will connect to Google.com over HTTPS to verify connectivity. You can fake DNS and redirect some apps to local servers, but you'll quickly run into issues with HTTPS connections. If you want to fake an Internet connection on Android using just DNS and HTTP, you'll probably end up bypassing some checks and failing others. Google's apps will likely all report that you don't have an internet connection and won't even try to connect, social media won't work, and other apps will get very confused but will probably still try to operate. You can work around some of these issues by becoming your own certificate authority and setting up TLS certificates for every website you need to mock, but on Android that'll be difficult to pull off in most apps. Browsers should work fine if you load up your own root certificate (though you need a special secret setting on Firefox for Android because of Mozilla reasons). For apps, you'd need to root your phone and place your root certificate in the right place on the system image (there are Magisk modules that can help you here). This will fix apps that opt out of user store certificates, but it will break Chrome, since Chrome requires certificates to be recorded in the certificate transparency logs, which you can't do. You can install the certificate in both stores to work around this issue. Most apps on either iOS or Android implement certificate pinning, which means even if you get your root certificate into the system trust store, you'll still see failed connections. You can hack those apps (for example, using Frida to patch the applications) but you'll have to do each app individually. I don't know the current status on the connectivity check on iOS, I believe you can get that to work with basic DNS and an HTTP server, but it's possible Apple has gone the HTTPS route too.

jqpabc123 3y ago
So basically, it's not practical to do this.
- jeroenhd 3y ago
  I've done it to monitor my phone for weird traffic, but I wouldn't recommend it unless you're dedicated and willing to deal with janky tooling. Magisk + mitmproxy + Frida + an isolated WiFi network works pretty well for traffic monitoring. With mitmproxy you can also write scripts to fake APIs (which can help you with your attempt to fake the network connectivity status).
  - jqpabc123 3y ago
    I'm looking to allow users with stock, unmodified software stack to easily connect to a local only wifi network with minimal headaches. Magisk, etc. is not an option.
    - jeroenhd 3y ago
      What's keeping you from connecting to the WiFi? As far as I know, Android and iOS can connect to offline networks just fine. You may need to disable the "network quality" test for that particular network, but I'm pretty sure stock Android stay connected just fine.
      - jqpabc123 3y ago
        It can be done --- just not easily or intuitively. To start, you have to enable "airplane mode" on your android phone. This shuts down all communication. If you don't do this your phone will try to use your wireless service for all communication. Next, you have to selectively enable wi-fi. If there are any other wireless networks in the area that you connect to automatically, you have to disable them, otherwise, your phone will connect and use one of them first. Finally, with all other communication options disabled, you can connect to and force your phone to reluctantly use the local network with no internet access.