Live data from Hacker News

Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

torrentfreak.com

11–20 of 83 posts

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#11

I wish to just use OpenVPN but it's not so easy. Certificates - no problem. Forward DNS requests - there is an option for it in the config file. Routing entire traffic through OpenVPN - quite tricky unless you're fluent in command line network management tools and computer networks in general.

Try OpenVPNs Access Server - it comes with 2 free licenses and a web UI to configure it. Makes the entire process quite straightforward: https://openvpn.net/index.php/access-server/pricing.html

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#12
Is there a way to make sure hola uninstalling the hola extension removed everything hola related from my pc? I can imagine with the level of access this extension had(I didn't even know Chrome extensions could have this level of access) just removing the extension isn't enough.

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#13
I have zero connection to this company but if you are looking for a reliable, fast, unlimited VPN I would check out Private Internet Access (https://www.privateinternetaccess.com/) I've got a number of friends who use this and I've been using it for a little over a month and have nothing but good things to say. At $40/yr it's well worth it IMHO and provides a native VPN client, PPTP, and Socks5 (They have mobile apps as well to make it easier but you can use PPTP directly as well).

I use it 100% of the time on my phone and on my laptop unless I'm at work (internal resources that I haven't figured out how to play nice with yet).

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#14

I wish to just use OpenVPN but it's not so easy. Certificates - no problem. Forward DNS requests - there is an option for it in the config file. Routing entire traffic through OpenVPN - quite tricky unless you're fluent in command line network management tools and computer networks in general.

There is also an option to route all traffic through the OpenVPN server, and the OpenVPN HOWTO has an entry for it: https://openvpn.net/index.php/open-source/documentation/howt...

Instead of using the push setting in the server config you can also set redirect-gateway in the client config.

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#16
Hola extension has been removed from Firefox and Chrome download sites. I read the source of the Firefox extension at one point and don't remember seeing any binaries or the so-called "zconsole". But CSO Online [1] is reporting the extensions were vulnerable (despite Vectra [2] not mentioning this).

It was also unclear to me how the browser extension could be used to share user's traffic; it didn't seem like the extension did that, but I didn't read the source code too carefully.

Does anyone has a copy of these extensions?

I am disappointed the Windows and Android apps were vulnerable and that Hola didn't market their software better. It's probably the coolest app since Napster. Yes, it's a botnet of sorts, but the Internet needs a way to let users disassociate themselves from IP addresses. And most proxy services are easily identified.

[1] http://www.csoonline.com/article/2928817/vulnerabilities/hol...

[2] http://blog.vectranetworks.com/blog/technical-analysis-of-ho...

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#17
I think that Chrome users are relatively unaffected by this if they installed the extension trough Google Play thanks to Chrome's security model. In that case I think it's just routing the traffic trough their proxy and not installing the shady zconsole or changing the SSL certificates.

Still, creating a new user profile just for watching netflix is recommended.

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#18

I have zero connection to this company but if you are looking for a reliable, fast, unlimited VPN I would check out Private Internet Access ( https://www.privateinternetaccess.com/ ) I've got a number of friends who use this and I've been using it for a little over a month and have nothing but good things to say. At $40/yr it's well worth it IMHO and provides a native VPN client, PPTP, and Socks5 (They have mobile ap…

I recently bought a year for around $35 with some coupon code or other and honestly...I'm a bit underwhelmed. No matter what settings I use or what node I connect to, my ~100mbps (down) cable connection drops to somewhere between 1-10mbps. I was originally going to set up OpenVPN on my router so everything would go through it but I heard it can tax router hardware and lead to slower speeds so I figured I'd just test the desktop client first. Now I'm glad I didn't go mucking around with my router setup since it would have led to house-wide issues. As it stands, I can handle the slower speeds when torrenting some TV episode I missed but after that, I usually need to turn it off.

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#19

I wish to just use OpenVPN but it's not so easy. Certificates - no problem. Forward DNS requests - there is an option for it in the config file. Routing entire traffic through OpenVPN - quite tricky unless you're fluent in command line network management tools and computer networks in general.

This is quite odd, most VPN routers make full tunneling very easy. Literally a checkbox in the control panel. It's when you want to do split tunneling that you have added the complexity of writing rules and sanity checking.

Re: Hola VPN Already Exploited by “Bad Guys”, Security Firm Says

#20

I wish to just use OpenVPN but it's not so easy. Certificates - no problem. Forward DNS requests - there is an option for it in the config file. Routing entire traffic through OpenVPN - quite tricky unless you're fluent in command line network management tools and computer networks in general.

I often use this tool. https://github.com/apenwarr/sshuttle

No need to configure anything at remote host, no excessive amount of options. Capable of DNS forwarding, routing of entire traffic or just traffic to chosen remote hosts.

Post reply on HN