Automatic app freezing on VPN — technical solution

# Anubis: Automatic App Freezing When VPN is Active

Popular apps in Russia scan devices for VPN usage and report outbound IP addresses to get them blocked. The solution? Automatic app freezing whenever VPN is on. Anubis, an open-source tool, blocks apps' background activity, making them invisible to detection systems.

Why Work Profiles Don't Solve the Problem

Android work profiles (Island, Insular) hide the VPN from ConnectivityManager, but they don't prevent network leaks. Apps in the work profile can still see:

• The tun0 interface via NetworkInterface.getNetworkInterfaces()
• Routes via /proc/net/route
• SOCKS5 proxy on localhost (port 1080 and others)

These checks work without permissions and align with the Ministry of Digital Development's 2026 guidelines. Even with profile isolation, the app can detect the VPN server's outbound IP address and send it to Roskomnadzor. The code below shows how the standard ConnectivityManager check is filtered between profiles:

// Code in rabochem profile not obnaruzhit VPN osnovnogo profilya
val cm = getSystemService<ConnectivityManager>()
val vpnActive = cm.allNetworks.any {
    cm.getNetworkCapabilities(it)
        ?.hasTransport(NetworkCapabilities.TRANSPORT_VPN) == true
}
// Result: vpnActive == false

Critical vulnerability in VLESS clients (unprotected SOCKS5 proxy) makes things worse. The app can not only detect the VPN but also use it to pinpoint the outbound IP. Techniques like triple-cascade VPNs just shift the problem—they don't eliminate it, as the spy will still grab the outbound IP of the first node.

Android's Architectural Limitations

Android doesn't use network namespaces for profiles, unlike desktop OSes. Virtualization (VirtualBox, QEMU) on PCs fully isolates the network stack, but on Android:

• The network stack is shared across all profiles
• Background activity is allowed via BroadcastReceiver, JobScheduler, FCM
• Doze Mode and App Standby don't guarantee a full stop

Even with perfect network isolation, background processes keep running. Apps with background activity permissions (banks, messengers) regularly check:

• Network status via system APIs
• Open ports on localhost
• Availability of blocked resources

Work profiles don't block these checks. The only reliable method is fully disabling the app via the system command pm disable-user.

How Anubis Works

Anubis monitors VPN state via VpnService and automatically disables target apps. Key components:

• System monitoring: Tracking CONNECTIVITY_ACTION events and VpnService state
• Package management: Calling PackageManager.setApplicationEnabledSetting() with the DONT_KILL_APP flag
• Target list: Filtering by package name (e.g., ru.max.messenger, ru.tbank)

Activation process:

• User turns on VPN
• Anubis receives the event via BroadcastReceiver
• For each app in the whitelist, pm disable-user is executed
• App icons disappear from the launcher, background processes stop

When VPN is turned off, the system automatically restores apps to working state. It requires the CHANGE_NETWORK_STATE permission and permission to change app states (via ADB or root):

# Akaktywatsiya komandy otklyucheniya for user-installed prilozheniy
adb shell pm enable-user --user 0 ru.target.app

Technical Implementation Details

Anubis bypasses Android's restriction on disabling user-installed apps through two approaches:

• ADB mode: Setup via computer for devices with debugging enabled
• Root access: Direct call to pm disable-user via su

For ADB use, one-time setup is required:

adb shell pm set-install-location 2
adb shell pm grant com.anubis.control android.permission.CHANGE_NETWORK_STATE

Important: After disabling, the app is fully isolated from the system. It doesn't receive broadcast events, has no network access, and can't start processes. This guarantees that even advanced detection methods (port scanning, route analysis) become impossible.

Key Takeaways

• Work profiles hide VPN only from ConnectivityManager, not from low-level network checks
• Apps' background activity stays active even in isolated profiles
• Full disable via pm disable-user is the only way to ensure no leaks
• Anubis automates the process, linking app states to VPN status
• Requires ADB or root to enable on user-installed apps

— Editorial Team