VPN, or Virtual Private Network, is a nifty agency to protect your daily online activities that locomote past times encrypting your information in addition to boosting security, every bit good every bit useful to obscure your actual IP address.
While closed to conduct VPN services for online anonymity in addition to information security, ane major argue many people role VPN is to enshroud their existent IP addresses to bypass online censorship in addition to access websites that are blocked past times their ISPs.
But what if when the VPN you lot idea is protecting your privacy is truly leaking your sensitive information in addition to existent location?
Influenza A virus subtype H5N1 squad of 3 ethical hackers hired past times privacy advocate theater VPN Mentor revealed that 3 pop VPN service providers—HotSpot Shield, PureVPN, in addition to Zenmate—with millions of customers worldwide were institute vulnerable to flaws that could compromise user's privacy.
The squad includes application safety researcher Paulos Yibelo, an ethical hacker known past times his alias 'File Descriptor' in addition to industrial plant for Cure53, in addition to whereas, the identity of 3rd ane has non been revealed on demand.
PureVPN is the same companionship who lied to convey a 'no log' policy, only a few months agone helped the FBI amongst logs that Pb to the arrest of a Massachusetts human inward a cyberstalking case.
After a serial of privacy tests on the 3 VPN services, the squad institute that all 3 VPN services are leaking their users' existent IP addresses, which tin endure used to position private users in addition to their actual location.
Concerning consequences for terminate users, VPN Mentor explains that the vulnerabilities could "allow governments, hostile organizations [sic], or individuals to position the actual IP address of a user, fifty-fifty amongst the role of the VPNs."
The issues inward ZenMate in addition to PureVPN convey non been disclosed since they haven't however patched, field VPN Mentor says the issues discovered inward ZenMate VPN were less severe than HotSpot Shield in addition to PureVPN.
The squad institute 3 split upward vulnerabilities inward AnchorFree's HotSpot Shield, which convey been fixed past times the company. Here's the list:
- Hijack all traffic (CVE-2018-7879) — This vulnerability resided inward Hotspot Shield’s Chrome extension in addition to could convey allowed remote hackers to hijack in addition to redirect victim's spider web traffic to a malicious site.
- DNS leak (CVE-2018-7878) — DNS leak flaw inward Hotspot Shield exposed users' master copy IP address to the DNS server, allowing ISPs to monitor in addition to tape their online activities.
- Real IP Address leak (CVE-2018-7880) — This flaw poses a privacy threat to users since hackers tin rail user's existent place in addition to the ISP. the number occurred because the extension had a unloose whitelist for "direct connection." Researchers institute that whatsoever domain amongst localhost, e.g., localhost.foo.bar.com, in addition to 'type=a1fproxyspeedtest' inward the URL bypass the proxy in addition to leaks existent IP address.
The researchers likewise reported similar vulnerabilities inward the Chrome plugins of Zenmate in addition to PureVPN, only for now, the details of the bugs are beingness kept nether wraps since both the manufacturers convey non however fixed them.
Researchers believe that almost other VPN services likewise endure from similar issues.
