Today I bring you a hotly guarded topic, and this may be the first article that I hesitate writing. There is a huge community of the internet that swear by VPN's and their protective attributes. Many defend their VPNs to the death, and I don't blame them. On the surface it seems like a great way to defend against some of the biggest actors. The ability to be “invisible” or behind a “proxy” is appealing to many. The sad reality is that anything that offers 100% is security lying to you. We have been shown time and time again how systems are vulnerable. Another fact is that VPNs are NOT a full-proof form of protection. They may be a good smoke-screen for low level hackers or scammers but against actors with resources they do not stand a chance. Through leaks from the Equation Group(NSA) we see that they have no issue breaking VPN protections. Not only can agencies break VPNs but nations can now shut down entire VPN services. This was shown by China's forceful reaction to one of their most popular VPN's.
“A VPN theoretically creates a secure tunnel between two points on the Internet. All data is channeled through that tunnel, protected by cryptography. When it comes to the level of privacy offered here, virtual is the right word, too. This is because the NSA operates a large-scale VPN exploitation project to crack large numbers of connections, allowing it to intercept the data exchanged inside the VPN -- including, for example, the Greek government's use of VPNs. The team responsible for the exploitation of those Greek VPN communications consisted of 12 people, according to an NSA document SPIEGEL has seen.” - http://www.spiegel.de
“GreenVPN sent a notice to customers that it would stop service from July 1 after “receiving a notice from regulatory departments,” without elaborating on those demands. VPNs work by routing internet traffic to servers in another location, such as the U.S., that is beyond the reach of Chinese filters.” - https://www.bloomberg.com
When nations can shut down a VPN service provider what is there to do? Yes you could connect to a VPN not in China from then on but you now leave more footprints behind. Personally, VPNs (If you don't know what you're doing) are a tagging system for agencies. All they need to do is attack the centralized point i.e. the VPN provider to hand over everything or risk going to prison. Some companies stayed loyal during these battles and were sent to prison while other VPNs turned over information about their clients.
“British virtual private network company Hide My Ass has said that it turned over logs on a suspected LulzSec member to the FBI in response to a UK court order.” - http://www.zdnet.com
“According to an NSA document dating from late 2009, the agency was processing 1,000 requests an hour to decrypt VPN connections. This number was expected to increase to 100,000 per hour by the end of 2011. The aim was for the system to be able to completely process "at least 20 percent" of these requests, meaning the data traffic would have to be decrypted and reinjected. In other words, by the end of 2011, the NSA's plans called for simultaneously surveilling 20,000 supposedly secure VPN communications per hour.” - http://www.spiegel.de
VPNs have become increasingly popular recently due to most of these providers accepting BTC and/or other cryptos. This has been great for the VPN market but this also caused many new VPN models and providers to rush in on the new market. Many providers are not battle hardened with experience and all we have to rely on is their word. Some VPNs have been tested and fought off many encounters that threaten their existence. With the ever evolving threats that are in the wild many VPN providers were forced to evolve their defenses as well. One new protective feature which should have been default was the “logging” scandal. Many VPNs were found to be logging everything. This was an obvious security risk which is why many VPNs started to offer no logging additions. There are still VPNs out in the market that log everything, so if you're using a VPN please inform yourself.
'...Nevertheless, they ordered PIA to hand over its logs. “A subpoena was sent to London Trust Media and the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States,” the FBI’s complaint reads.“However, London Trust did provide that they accept payment for their services through credit card with a vendor company of Stripe and/or Amazon. They also accept forms of payment online through PayPal, Bitpay, Bit Coin, Cash You, Ripple, Ok Pay, and Pay Garden.”In the event the FBI was unable to link McWaters to any payment to the company. However, they did find a payment to another provider.”' - https://torrentfreak.com
It would be assumed that if you were in the market for a VPN you would look into these sorts of things but there are VPN companies that log everything and tell you otherwise. Although, there is a market for people not worrying about that much protection. Most VPN users seem to just want to get away from their countries restrictions, and not hide from their government. There are instances where people are hunted by their government and need to use services like these and if they use the “wrong” VPN they will be compromised.
“VPNs are popular in China because the government limits access to a raft of content, from news and video to politics and pornography that it deems to be undesirable. For many internet users, services that enable them to bypass the Great Firewall are the only way to access Facebook, Twitter and the websites of the New York Times. Long a legal gray area, VPNs are commonly used by businesses, universities, and news organizations – including state-run newspapers – in China.” - https://www.bloomberg.com
In conclusion, VPNs are decent for people that want to go past their government restrictions. But, if you're trying to hide from a government or use it because your life is in danger, they are not the best solution. Do the research if your life is in danger, take it into your own hands and try to rely on as little people as possible. There are other viable and tested solutions depending on what you want to do. One battle hardened solution is Tor and Tails. These programs can be used by anyone and are simple to use. If you have a critical need for them, then you need to understand how they work. I highly recommend looking into these programs even for your daily needs of staying “off the grid”. There are many ways to use these tools so keep that in mind. Also remember that even Tor is not full-proof and they state this fact themselves. Think of Tor, Tails, and VPNs as tools, not all tools will allow you to hammer a nail(Unless you're creative). Also never use these on a Windows OS if you're in a critical position. But, if you're that deep into the matrix then you should already understand these threats, otherwise you wouldn't survive.
“The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked.” - https://www.torproject.org
“Tor can't solve all anonymity problems. It focuses only on protecting the transport of data. You need to use protocol-specific support software if you don't want the sites you visit to see your identifying information.” - https://www.torproject.org
“Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly. It is a complete operating system designed to be used from a DVD, USB stick, or SD card independently of the computer's original operating system.” - https://tails.boum.org
Tor: https://www.torproject.org/projects/torbrowser.html.en
Tails: https://tails.boum.org/
NSA High Level Description on TURMOIL / APEX Programs on Attacking VPN
Explanation of the GALLANTWAVE that decrypts VPN Traffic within LONGHAUL
Intro to the VPN Exploitation Process mentioning the protocols attacked - PPTP, IPSEC, SSL, SSH)
Analytic Challenges from Active-Passive Integration when NSA attacks IPSEC VPNs
Overview of the capabilities of the VALIANTSURF program
MALIBU Architecture Overview to exploit VPN Communication
POISENNUT Virtual Private Network Attack Orchestrator (VAO)
NSA Presentation on the development of Attacks on VPN
NSA Presentation on the Analysis and Contextualisation of data from VPN
Description of existing projects on VPN decryption
Explanation of the Transform Engine Emulator when attacking VPN
Explanation of the POISENNUT Product and its role when attacking VPN
Explanation of the TURMOIL GALLANTWAVE Program and its role when attacking VPN
Processing of data from exploited VPN in the TURMOIL program
Decryption of VPN Connections within the VALIANTSURF program
Description on the processing of VPN data packets within the TURMOIL program
Explanation on the SPIN9 program on end-to-end attacks on VPN
(These were links to PDFs of the attacks in detail, I will not link them here due to them being TOP SECRET) You can find out more here: http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html
P.S. Would love to hear about your opinions in the comments.
Do you use a VPN? (You shouldn't tell anyone anyway)...
Maybe answer this last question in your head...
Do you know if your VPN has logs on you?
Stay safe,
-Citizen
