Slashdot Mirror
Cyberstalking Suspect Arrested After VPN Providers Shared Logs With the FBI (bleepingcomputer.com)
An anonymous reader writes:
"VPN providers often advertise their products as a method of surfing the web anonymously, claiming they never store logs of user activity," writes Bleeping Computer, "but a recent criminal case shows that at least some do store user activity logs." According to the FBI, VPN providers played a key role in identifying an aggressive cyberstalker by providing detailed logs to authorities, even if they claimed in their privacy policies that they don't. The suspect is a 24-year-old man that hacked his roommate, published her private journal, made sexually explicit collages, sent threats to schools in the victim's name, and registered accounts on adult portals, sending men to the victim's house...
FBI agents also obtained Google records on their suspect, according to a 29-page affidavit which, ironically, includes the text of one of his tweets warning people that VPN providers do in fact keep activity logs. "If they can limit your connections or track bandwidth usage, they keep logs."
FBI agents also obtained Google records on their suspect, according to a 29-page affidavit which, ironically, includes the text of one of his tweets warning people that VPN providers do in fact keep activity logs. "If they can limit your connections or track bandwidth usage, they keep logs."
This is a good reminder that you shouldn't put much faith in the claims made by service providers.
... you'll be anonymous, they said.
I'm bookmarking this article for reference material for the VPN fanbois.
It little behooves the best of us to comment on the rest of us.
Alright then.
And WANSecurity.
But the take-home lesson here shouldn't be that if you avoid those you're good. The lesson is that in the end, you're taking every provider's word for security. Certainly some are good and some aren't, but there is literally no way for you to be able to tell which ones are good.
VPN vendors were PureVPN and WANSecurity.
He also used a secure email and Tor but no indication that logs or info was pulled from those.
--For the karma whoring.
Please don't post your sexual fantasies. There are forums where that may be appropriate but this isn't one.
https://torrentfreak.com/vpn-s...
Never heard of these VPN services, but if you stick to VPNs that have been reviewed and tested for privacy over the years they are fine. See above link for good reviews..noticed PUREVPN was never reviewed?
I just looked over PureVPN's site and policies and they make no claim about logging one way or the other. Which means that they log everything.
VPNs are really only ever intended for general purpose anonymity any how. If you are compelled to engage in illegal activity you should be using non-repudiable uplinks and not those you pay for with your credit card then use everyday to log in to your email and the rest of your heavily logged web accounts.
Most of the damning info came from a laptop, and all the VPNs did was confirm an IP address for his residence was used to connect to one of their IP addresses during the same time frame "someone" logged into both the victim's e-mail account and the abuser's e-mail account -- both from the same VPN address.
PureVPN lists what data it records and states it cooperates with investigations. The only thing I can find that they gave to investigators that wasn't explicitly stated in the TOS was that they gave the origin IP address for the connection. but... the TOS already says they store the name of the person on the account and connection times and bandwidth anyway, so that's pretty damning to begin with if requested by law enforcement.
Basically, Law Enforcement said:
"Hey we have a laptop with evidence that you have a VPN and have accessed both the victim's and the abuser's e-mail addresses. We just checked with the e-mail services and discovered a login to both from a VPN IP address within a short time period."
And the VPN provider upon court order said:
"That user was logged into our service from their residential IP address during that time and was connected to that same VPN IP address (along with many other users). Here's the amount of time they were on our system and the amount of bandwidth they used."
The VPN didn't rat out what site they went to -- but the sites they went to DID keep IP logs.
In short, the VPN service provided exactly what it said it would record and it just happened to correlate nicely with what the detectives found. It's not proof, but it's strong evidence.
Frankly, I'm a little surprised the victim's e-mail service allowed a connection to a VPN IP to begin with. I'm also surprised this moron thought that just because a VPN doesn't record every site you visit that the sites themselves wouldn't be recording every login and IP address along with cookies that might identify his specific hardware and/or tie into a social media profile or the like.
You could roll your own VPN by purchasing a VPS and routing your traffic through it but even that will only give you a little bit more privacy. At some point the data that you send will have to be decrypted in order to be sent out to the internet at large. Authorities can see the point at which the decryption is taking place and trace it back to that end-point IP address. It is a trivial matter to see who the IP address belongs to. The VPS provider could then be issued a subpoena to get your information. The whole VPN thing is really misunderstood. It's really a way to make it harder for an ISP to grab and monetize your browsing data or even a way to protect your identity on an untrusted network.
Special Agent in Charge of the Federal Bureau of Investigation, Boston Field Division. “This kind of behavior is not a prank, and it isn't harmless. He allegedly scared innocent people, and disrupted their daily lives, because he was blinded by his obsession. No one should feel unsafe in their own home, school, or workplace, and the FBI and our law enforcement partners hope today's arrest will deter others from engaging in similar criminal conduct.”
This jerk has degraded the trustworthiness of ALL bomb threat calls, ALL emergency distress calls. As incidents like this increase, as people figure out better ways to hide their tracks, more people will do such things. In the end the police and emergency services will take time to check veracity and trustworthiness of the caller before responding. False alarms will increase cost for all tax payers. Some stalking victims could actually be raped or violated due to such postings.
This guy is evil, he should be punished so severely others don't even fantasize doing such things.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
And WANSecurity.
But the take-home lesson here shouldn't be that if you avoid those you're good. The lesson is that in the end, you're taking every provider's word for security. Certainly some are good and some aren't, but there is literally no way for you to be able to tell which ones are good.
I'd primarily use a VPN provider to make life harder for the RIAA, MPAA, Sony, HBO, and the rest of that ilk and to make it harder for them to identify me and then sue me for damages because they themselves forced me to torrent their movies and music because of their own artificial trade barriers (and I'd preferably use a VPN service headquartered in Europe to make it that little bit harder since most of these corps are US based which significantly increases the legal complexities). I have no delusions about a simple VPN service shielding me from a determined FBI/CIA/MI6/BND/FSB/NSA/DGSE effort to identify me. If those guys really want you, they are going to get you, just ask Osama.
Sure you can write disparaging remarks, insult other people anonymously; but the moment you start performing malicious actions causing deliberate targeted harm, that mask can come off mighty fast.
I don't read AC
Adj.
1 almost or nearly as described, but not completely or according to strict definition.
Down vote this post to oblivion, please.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Something doesn't sound quite right about this. From TFA:
The logs showed how within the span of minutes the same VPN IP address had logged into Lin's real Gmail address, another Gmail address used for some of the threats, and a Rover.com account Lin created to discover Smith's real phone number.
Gmail has forced HTTPS since 2014. What are we being asked to believe here?
VPN services are nice if you want to pretend to be in another geographically location, but the claims of security are pure marketing. Incidentally, anybody that cares to find out knows that. And no VPN service that is run commercially can say "no" when the Feds want logs to be recorded and handed to them. Lavabit is an extremely rare exception (and just did anonymous email, not VPN) and it can be seen nicely in their case what happens after such a "no". The CEO is lucky to not end up in prison.
At this time, the only VPN service with actual security is Tor and even there, you anonymity can be compromised by attacks on the client or making mistake while using it. And, of course, a large-scale traffic analysis can break even Tor. The thing with Tor is however, that nobody that can break it will admit so for a mere cyberstalking case. It would have to be something really, really large for anybody to admit that they can compromise Tor itself.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
None. Anybody sane already knows VPNs are not secure if anybody can get a court-order against them. All the others are to dumb to care.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
If you depend on Tor you better not get the Feds after you. It's *probably* safe against anyone else, but, IIRC, the Feds were reported own enough of the exit nodes to track you. That was a few years ago, but I doubt they've decreased their penetration.
Still, it's probably more secure than a VPN is even designed to be.
But do note all the "probably"s in my comments. And recall that Google is working hard on getting a quantum computer to perform well. (And it's not the only gang so working.) So almost all of the security in use on the internet has to be considered temporary. The only exceptions, currently, are one time pads and anything that doesn't get recorded (and how can you tell). But "temporary" may mean 10 years, and it may mean 20 years. That's long enough for many purposes. (I consider widespread use within less than 10 years quite unlikely.)
I think we've pushed this "anyone can grow up to be president" thing too far.
This guy was a major asshole. I hope when he gets out, his terms of parole include "never allowed to touch a computer for any reason."
That's proxies. Not VPN providers.
And seven wasn't enough, remember?
Do not look into laser with remaining eye.
By the time my son was five, he already understood that the "he forced me to do it" defense is, unless someone literally has a gun to your head, a cowardly lie.
Time to take responsibility for your own actions. It's what adults do.
And no VPN service that is run commercially can say "no" when the Feds want logs to be recorded and handed to them.
Sure they can. By "feds" I'm assuming you one of America's three letter agencies. The reality is that there are many countries in the world who don't play America's bullshit game.
does your VPN (website, Tor network, etc) hosts child pornography, Islamic State glorification materials, bomb making manuals?
If yes, then the website is private.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
As a PureVPN lifetime customer, this is disappointing on PureVPN's side. At least it sounds like they didn't rat out the traffic, but did origin IP address, which is pretty damning in most cases.
I would also like to point out, that PureVPN was being sold right here on the Slashdot site for lifetime memebership for quite a while (maybe still). That is the offer that I grabbed a year or two ago. While I use it mostly to protect my privacy when using open hotspots or hotel/shared wifi connections, and also occasionally for torrents (legal linux ISO's only!), that I think it would still be fairly reliable for this, however it's never good to know that if you've been targeted, there is enough info to use against you being logged.
bummer. At least I knew this was a possibility and am not shocked, just more disappointed.
You are openly violating the rules and terms of Slashdot. You're not welcome. Fuck off and find some other site to spam. Now fuck off.
You can just say Trump.
Good luck with that. Sure, in some countries they may just shoot you if you refuse to hand over the logs, but in most countries refusing a court order will get you just under threat of being locked up. This "bullshit game" is played all over the globe.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Sure, in some countries they may just shoot you if you refuse to hand over the logs
No you misunderstand. Most countries don't give a flying fuck about the USA or USA problems, and especially don't give a flying fuck about the moaning of the USA corporate welfare.
The point of VPN endpoints is to appear somewhere outside the reach of those trying to persecute you. A Chinese person will be just fine using a Ukrainian VPN with a Swedish endpoint to escape from China's watch, regardless of how much is logged. Likewise the USA can't even get basic enforcement against known criminals in other countries, let alone persecute someone using a foreign VPN service with an even more foreign endpoint.
Not every corporation or country is beholden to the not-as-far-reaching-as-you-think eyes of the USA's TLAs. You just need to not commit a crime in the country where your VPN is hosted or end-pointed. That is pretty easy to do. Bonus points if you pick a country that actively hates the one you're trying to avoid.
Well, good luck with that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I've been told, by people who appear to know what they're talking about, that quantum computers are limited in what they can do. For example, they can cut the effective key length for a cipher in half, but not more. That would mean that AES-256 is invulnerable to brute-force attacks using quantum computers (at least using only the current resources of the entire Solar System).
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Cheers.
Except he's not the only one - his cronies are doing his bidding as well
AC comments get piped to