Is disabling DHCP a mitigation?
Attackers can decloak routing-based VPNs
141–150 of 238 posts
Re: Attackers can decloak routing-based VPNs
#142Well written, I appreciated the background. Far more enjoyable to read than a good deal of the incoherent articles posted on here.
Re: Attackers can decloak routing-based VPNs
#143Earlier quoted context omitted.
Well said. This is a nothing-burger for all VPNs except the ones that are likely heavily leaking already due to the absence of basic firewall rules. Their "side channel attack" also made me spit out my drink. EDIT: looks like NordVPN (at least on mac) doesn't have those basic firewall rules and so IS vulnerable to this exploit.
A general rule for life is that companies making a big deal about military grade encryption or about how they are affiliated with Nordic countries are scams.
Can you expand on that? Specifically the affiliation with Nordic countries?
I’m a Nord VPN customer, I’d quite like to know more — may help inform any future decision on renewing or even staying with them.
Re: Attackers can decloak routing-based VPNs
#144VPN can be trivially defeated any number of ways. I was shocked when I first learned this ten fifteen years ago through a site that showed my internet provider and location despite being on a VPN. I forgot the name of the site. A huge problem that doesn't even require defeating is, most OSs and VPN clients, if the connection is shaky, just reverts to the default connection. Even a single packet is enough for your VPN…
What leaks your location might just be a DNS request. Depends on the configuration.
The site can include a completely unique DNS name as a part of a page. Something like "a5afbdeffe.attacker.com".
Re: Attackers can decloak routing-based VPNs
#145Earlier quoted context omitted.
A general rule for life is that companies making a big deal about military grade encryption or about how they are affiliated with Nordic countries are scams.
Can you expand on that? Specifically the affiliation with Nordic countries? I’m a Nord VPN customer, I’d quite like to know more — may help inform any future decision on renewing or even staying with them.
In general, Nordic countries are known for their extensive privacy laws, which in theory would make it harder for law enforcement to gain access to your traffic (and with a court order it is very easy to decloak your VPN traffic). However, as all Nordic countries are part of the Schengen Area, they are bound by European laws - and their enforcement. When Europol started cracking down on VPN providers that didn't comply, NordVPN (and all others who wanted to remain in the European market) were forced to admit [1] that they do comply with law enforcement orders. Today, all VPNs that you can legally buy are worthless in the aspects they advertise to you. You neither get extra security through encryption when browsing the web (https is already good enough for public wifi) nor actual privacy from your own government. There is exactly one use case for public commercial VPNs these days: If you want to easily access the internet from a different location to bypass geoblocking. But many big services like Netflix have started to simply block or otherwise limit access from traffic that comes from big VPN provider IP ranges, so even that use-case is becoming more worthless every year.
[1] https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit...
Re: Attackers can decloak routing-based VPNs
#146Earlier quoted context omitted.
Can you expand on that? Specifically the affiliation with Nordic countries? I’m a Nord VPN customer, I’d quite like to know more — may help inform any future decision on renewing or even staying with them.
In general, Nordic countries are known for their extensive privacy laws, which in theory would make it harder for law enforcement to gain access to your traffic (and with a court order it is very easy to decloak your VPN traffic). However, as all Nordic countries are part of the Schengen Area, they are bound by European laws - and their enforcement. When Europol started cracking down on VPN providers that didn't comp…
Even Mullvad?
Re: Attackers can decloak routing-based VPNs
#147Earlier quoted context omitted.
In general, Nordic countries are known for their extensive privacy laws, which in theory would make it harder for law enforcement to gain access to your traffic (and with a court order it is very easy to decloak your VPN traffic). However, as all Nordic countries are part of the Schengen Area, they are bound by European laws - and their enforcement. When Europol started cracking down on VPN providers that didn't comp…
Even Mullvad?
You can answer the question yourself for any provider using this simple test: Can you legally buy access to it from inside the EU? If yes, they will suffer from the same problem as all other providers.
Re: Attackers can decloak routing-based VPNs
#148Earlier quoted context omitted.
Even Mullvad?
You can answer the question yourself for any provider using this simple test: Can you legally buy access to it from inside the EU? If yes, they will suffer from the same problem as all other providers.
What are these problems, exactly?
Re: Attackers can decloak routing-based VPNs
#149Earlier quoted context omitted.
In general, Nordic countries are known for their extensive privacy laws, which in theory would make it harder for law enforcement to gain access to your traffic (and with a court order it is very easy to decloak your VPN traffic). However, as all Nordic countries are part of the Schengen Area, they are bound by European laws - and their enforcement. When Europol started cracking down on VPN providers that didn't comp…
Even Mullvad?
Mullvad complies, but they go out of their way to keep very little information. If you don't have the information in the first place, you can't surrender it.
Re: Attackers can decloak routing-based VPNs
#150Earlier quoted context omitted.
You can answer the question yourself for any provider using this simple test: Can you legally buy access to it from inside the EU? If yes, they will suffer from the same problem as all other providers.
What are these problems, exactly?
As I said above, a simple court order can destroy any attempt at privacy. All (serious) VPN providers claim they don't store logs. But that does not mean that a court can't force them to do so. When combined with a gag order you can have someone collecting all your traffic without you even realizing it. And that's just the VPN provider, which usually doesn't own any datacenters. The datacenter providers can also receive the orders to either monitor traffic or even install hardware to do so. If you want any hope of privacy, you steer clear of all big commercial "privacy" providers, because they are very high on every government agency's list. And you just need one component in the entire chain to be compromised.