VPN users, beware: You may not be as safe as you think you are

Thanks to IPv6 leakage, your data could be out there for anyone to see

Security

Security

It's become common practice to use virtual private networks for extra privacy and security in this era of mass surveillance, but a study published this week suggests such networks may not be as safe as they're commonly made out to be.

In fact, because of a vulnerability known as IPv6 leakage, many of them can expose user information to prying eyes, according to a paper from researchers at Sapienza University of Rome and Queen Mary University of London.

Entitled "A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients," the report describes a study conducted late last year that examined 14 popular commercial VPN providers around the world.

Specifically, the researchers tested the VPNs by attempting two kinds of attacks: passive monitoring, whereby a hacker might simply collect the user's unencrypted information, and DNS hijacking, where the hacker would redirect the user's browser to a controlled Web server by pretending to be a popular site like Google or Facebook.

What they found was unnerving: 11 of the 14 providers leaked information, including the websites the user was accessing and the actual content of the user's communications. The only three that didn't were Private Internet Access, Mullvad and VyprVPN. TorGuard offered a way around the problem, they noted, but it wasn't enabled by default.

The study also examined the security of various mobile platforms when using VPNs and found that they were much more secure when using iOS but were still vulnerable to leakage using Android.

Interactions with websites running HTTPS encryption were not leaked, the researchers noted.

So what's to blame for the leakage? One factor is that while network operators are increasingly deploying IPv6, many VPNs still protect only IPv4 traffic, the researchers concluded.

Another problem they found, however, is that many VPN service providers still rely on outdated tunneling protocols such as PPTP that can be easily broken through brute-force attacks.

The authors point to Tor along with Linux distributions such as Tails as potential alternatives for those seeking anonymity. Enterprise VPNs, meanwhile, are largely unaffected by the leakage problems, they said.

"For the average business user of VPN technology, there is no impact," said Steve Manzuik, director of research at Duo Security.

Users who rely on VPN services for privacy, however, should "always be aware of what protocols their systems are transmitting on and consider a VPN service that also provides coverage for those or at the very least disable those that are unused," Manzuik advised.

It's also worth noting that VPN technology was not designed to offer privacy so much as to offer a more secure way to connect to an organization's internal network infrastructure via untrusted networks, he pointed out.

"Even with a well-configured VPN in place," Manzuik said, "there are other methods to identify a user and violate their perceived privacy."

Join the PC World newsletter!

Error: Please check your email address.

Tags NetworkingsecurityQueen Mary University of Londonmobile securityvpnSapienza University of Romeencryption

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Katherine Noyes

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?