Critical vulnerabilities discovered in three popular VPN services that could leak users' real IP addresses and other sensitive data.
VPN, o Virtual private network, is an excellent way to protect your daily online activities by encrypting your data and increasing security, in addition to being useful for hiding your real IP address. While some choose VPN services for online anonymity and data security, one of the main reasons many people use VPNs is to hide their real IP addresses and bypass online censorship to access websites blocked by their ISPs (Internet providers).
¿Pero qué ocurre si la VPN que crees que protege tu privacidad está filtrando tus datos confidenciales y tu ubicación real?
Un equipo de tres hackers éticos contratados por la firma defensora de privacidad VPN Mentor reveló que tres populares proveedores de servicios VPN: HotSpot Shield, PureVPN y Zenmate, con millones de clientes en todo el mundo, eran vulnerables a fallas que podrían comprometer la privacidad del usuario.
El equipo incluye al investigador de seguridad de aplicaciones Paulos Yibelo, un hacker ético conocido por su alias ‘File Descriptor’ y trabaja para Cure53,la identidad de los otros investigadores no se ha revelado todavía.
PureVPN is the same company that a few months ago helped the FBI with the logs that led to the arrest of a man in Massachusetts in a cyberstalking case.
After a series of privacy tests on the three VPN services, the team discovered that they are leaking users' real IP addresses, which can be used to identify them and their real location.
Regarding the consequences for end users, VPN Mentor explains that the vulnerabilities could “allow governments, hostile organizations or individuals to identify a user's real IP address”.
The team found three separate vulnerabilities in AnchorFree's HotSpot Shield, which have been fixed by the company.
It should be noted that the three vulnerabilities were in the free Chrome extension of HotSpot Shield, not in the desktop or smartphone applications.
Researchers also reported similar vulnerabilities in the Chrome extensions of Zenmate and PureVPN, but for now, the details of the bugs are being kept secret since the manufacturers have not yet fixed them.