This is not your problem, but a question

[sasamy]

Hi,
can your proxy block selected applications from accessing its port on localhost? This is a known vulnerability in Android that currently cannot be fixed using its built-in tools, and which is used to spy on users and detect VPN usage?
https://habr.com/ru/articles/915732/

[tazhate]

Hi! Good question, and unfortunately the honest answer is: no, not really — and this is an Android platform limitation, not something I can fix in userspace.

Here's the breakdown:

1. The proxy binds to 127.0.0.1 (localhost), and any app on the device can connect to that port. The VPN/split-tunneling layer doesn't help here — localhost traffic never enters the tun interface, so VpnService can't filter it.

2. There's no reliable way for an unprivileged app to identify the UID of a peer connecting to a TCP localhost socket on modern Android:

   • SO_PEERCRED works only for AF_UNIX sockets, not TCP.
   • /proc/net/tcp is restricted since Android 10 (returns only your own app's sockets).
   • /proc/<pid>/... of other apps is blocked by SELinux.

   So the proxy literally cannot tell which app just connected to it.

3. The article you linked describes the inverse problem — malicious apps probing 127.0.0.1:<port> to fingerprint installed apps / detect VPNs. The mitigation has to come from the listening side (the proxy), but as above, the OS doesn't give us the tools.

What can help, partially:

• Bind to a random high port on each start — raises the bar a bit, doesn't solve it.
• Switch the local interface to a Unix domain socket and require apps to opt in via a custom client lib — breaks compatibility with standard SOCKS clients, so not realistic for a general-purpose proxy.
• Run the proxy as VpnService only and stop exposing a localhost port at all — possible, but then you lose the "use this from any SOCKS-aware app" use case.

Realistically this needs to be fixed at the Android framework level (per-app inbound localhost ACL or UID labeling on TCP loopback). Until then any localhost-listening proxy on Android has the same exposure.

I'll keep this issue open as a tracking item — if anyone has ideas, PRs welcome.