Slashdot Mirror
Privacy-Busting Bugs Found in Popular VPN Services Hotspot Shield, Zenmate and PureVPN (zdnet.com)
A report by VpnMentor, a website which ranks VPN services, reveals several vulnerabilities in Hotspot Shield, Zenmate, and PureVPN -- all of which promise to provide privacy for their users. VpnMentor says it hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs. While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo. ZDNet: The research reveals bugs that can leak real-world IP addresses, which in some cases can identify individual users and determine a user's location. In the case of Hotspot Shield, three separate bugs in how the company's Chrome extension handles proxy auto-config scripts -- used to direct traffic to the right places -- leaked both IP and DNS addresses, which undermines the effectiveness of privacy and anonymity services. [...] AnchorFree, which makes Hotspot Shield, fixed the bugs, and noted that its mobile and desktop apps were not affected by the bugs. The researchers also reported similar IP leaking bugs to Zenmate and PureVPN.
So what VPN provider do you people recommend?
You know you just cannot trust anyone to provide what they say anymore. I guess they figure most people are too dumb to figure it out.
Use a real VPN client like openvpn with appropriate firewall rules instead.
The article makes it sounds like these companies offer a VPN service, but weirdly, it also talks about them supplying software. No sane user will ever be doing both.
Just a little reminder, or in case there's anyone here who has never used a computer for: one of the first things every single computer user eventually learns, is that you don't ever want to get hardware, software, or services from the same entity. Sometimes exceptions happen that you can't practically do anything about, but even so, those exceptions are always bad and long-term they almost always result in loss. (Most common example: handheld phone/pc comes with preloaded OS. Half the time, this kind of fuckup ends with retiring the hardware earlier than it's obsolete, simply because you can't upgrade the software.)
In the context of VPNs, this means you shouldn't be getting any software from the VPN company. Just use standard software (e.g. OpenVPN), and only select services that work with the standard. The standard software will be great, so don't worry!
Or if someone makes a VPN "app" that you like, you can make sure it's standard by using it with some other company's VPN service.
Standards help keep everyone honest and competent, and you should always be using them at any well-understood interfaces. If you screw this up, there are lots of companies that basically make their whole living off exploiting your naivety. Their most common attack is lock-in, but really, there's lots more things that can (and sometimes do) go wrong.
Opinion: All VPN's have CIA backdoors and are heavily monitored.
Change my mind.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Those products need to be renamed to avoid false advertising -- not really their hallmark, so the names must go. PureVPN? shall now be known as WaterdownVPN, zenmate as zentimates, etc. I'm sure their marketdroids can be given one last duty to fulfill, before the doors close at the end of the business day.
Change my mind.
You have already closed up your thinking on this topic. We'd just be wasting our time.
There's holes in software, intentional or otherwise. There's holes in hardware that we can't do shit about. There's holes in services for various reasons ranging from incompetence to greed to coercion. It all depends ... do you want to conceal yourself more than someone else wants to find you?
By the way, fuck the term "ethical hackers." Seriously, get the fuck out of here. You're not ethical, you do it for the money. Ethics are arbitrary anyway.
Run your own.
It really isn't that hard to setup an openvpn with AES256 encryption either at home or on a VPS. Having one at home allows secured access to your home network from anywhere. Just don't use DNS to make the connection, use the WAN IP.
If you want to hide what you do from home, then get a VPS somewhere using a pre-paid credit card that isn't connected to your name and go to town. Probably want the VPS to be outside your country and probably NOT in a country friendly with yours.
Once you know what you are doing, these things take 2 minutes to build from a fresh Linux install. Plus, you can wipe the logs (or disable them completely) if you don't want any evidence remaining.
There are some reputable VPNs - they don't do business in mainland China or Russia, thanks to laws in those places that require the PKI keys to be turned over to the state. One has survived an FBI demand for data without providing any data. There is a catch, however. They have logs for active connections. Those logs are removed 3 minutes after the connection is closed. That means we don't want to leave connections up 24/7/365. I tend to use it for 3-5 hrs at a time, then drop.
My home VPN lets me use nextcloud and other cloudy services in a self-hosted way so I don't have to trust or believe the massive cloudy services that most of you sheeple seem to trust. Baaaaah.
Seriously folks, you want a cheap secure VPN to do whatever you want with? Rent yourself a t2.micro instance on Amazon Web Services, setup OpenVPN and go crazy. It's not even exceptionally difficult. You control it all, the logs, the keys, the server, you decide what gets saved and what gets discarded.
The cost? About $9/mo for the instance runtime, plus your bandwidth (first 1GB is free, after that, 9 cents a GB, previously I'd posted you pay for bandwidth in both directions, but that's not true. You pay for data out, not data in.)
Never heard of 'em.
Good thing we only use reliable big name VPNs including Cisco and Checkpoint.
These companies are in business to provide said services. You'd think they would have performed this kind of analysis themselves.
But apparently Testing the product is not all that important. Proper design - maybe. Or are they repackaging something and offering it up with more Marketing than Security. Sure security and animinity are a thin sheet.(where there's a will there's a way).
While I appreciate an independent review to keep everyone honest - you'd think the bugs would be harder to find or more obscure in nature.
I have to go - my virus scanner is out of date and requires updating.