VPN users, beware: You may not be as safe as you think you are

Thanks to IPv6 leakage, your data could be out there for anyone to see



It's become common practice to use virtual private networks for extra privacy and security in this era of mass surveillance, but a study published this week suggests such networks may not be as safe as they're commonly made out to be.

In fact, because of a vulnerability known as IPv6 leakage, many of them can expose user information to prying eyes, according to a paper from researchers at Sapienza University of Rome and Queen Mary University of London.

Entitled "A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients," the report describes a study conducted late last year that examined 14 popular commercial VPN providers around the world.

Specifically, the researchers tested the VPNs by attempting two kinds of attacks: passive monitoring, whereby a hacker might simply collect the user's unencrypted information, and DNS hijacking, where the hacker would redirect the user's browser to a controlled Web server by pretending to be a popular site like Google or Facebook.

What they found was unnerving: 11 of the 14 providers leaked information, including the websites the user was accessing and the actual content of the user's communications. The only three that didn't were Private Internet Access, Mullvad and VyprVPN. TorGuard offered a way around the problem, they noted, but it wasn't enabled by default.

The study also examined the security of various mobile platforms when using VPNs and found that they were much more secure when using iOS but were still vulnerable to leakage using Android.

Interactions with websites running HTTPS encryption were not leaked, the researchers noted.

So what's to blame for the leakage? One factor is that while network operators are increasingly deploying IPv6, many VPNs still protect only IPv4 traffic, the researchers concluded.

Another problem they found, however, is that many VPN service providers still rely on outdated tunneling protocols such as PPTP that can be easily broken through brute-force attacks.

The authors point to Tor along with Linux distributions such as Tails as potential alternatives for those seeking anonymity. Enterprise VPNs, meanwhile, are largely unaffected by the leakage problems, they said.

"For the average business user of VPN technology, there is no impact," said Steve Manzuik, director of research at Duo Security.

Users who rely on VPN services for privacy, however, should "always be aware of what protocols their systems are transmitting on and consider a VPN service that also provides coverage for those or at the very least disable those that are unused," Manzuik advised.

It's also worth noting that VPN technology was not designed to offer privacy so much as to offer a more secure way to connect to an organization's internal network infrastructure via untrusted networks, he pointed out.

"Even with a well-configured VPN in place," Manzuik said, "there are other methods to identify a user and violate their perceived privacy."

Join the CSO newsletter!

Error: Please check your email address.

Tags NetworkingsecurityQueen Mary University of Londonmobile securityvpnSapienza University of Romeencryption

More about FacebookGoogleInternet AccessLinuxUniversity of London

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Katherine Noyes

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place