Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Two Popular VPNs Exposed Users to Attacks Via Fake Updates

Researchers analyzed some of the most popular VPNs and discovered that two of them were affected by vulnerabilities that could be exploited to hack users’ devices.

Researchers analyzed some of the most popular VPNs and discovered that two of them were affected by vulnerabilities that could be exploited to hack users’ devices.

VPNpro, a company that specializes in analyzing and comparing VPN services, analyzed the 20 most popular VPNs to see which of them allow attackers to intercept communications and push fake updates.

The analysis revealed that PrivateVPN and Betternet VPNs were vulnerable to these types of attacks. Both vendors were notified in mid-February and they have released patches that should prevent attacks.

“The most important part of the fix is that they don’t accept unverified update files anymore. Since we were intercepting only update network requests, the issue no longer exists,” VPNpro told SecurityWeek.

The analysis revealed that PrivateVPN, Betternet, TorGuard and CyberGhost allowed an attacker to intercept the connection, and the VPN connected while being intercepted. However, only PrivateVPN and Betternet downloaded a fake update, and PrivateVPN even executed the update automatically. Betternet did not automatically execute the update, but prompted the user to update the app, which in many cases would also likely lead to execution of the fake update.

According to VPNpro, a man-in-the-middle (MitM) attacker could have intercepted the targeted user’s VPN connection and pushed a fake software update. In the most likely scenarios, the attacker convinces the victim to connect to a malicious Wi-Fi network in a public location, or they somehow gain access to the target’s router.

The malicious software update could have unleashed a piece of malware on the victim’s device. This includes ransomware or malware designed to steal sensitive information, abuse the compromised device for cryptocurrency mining, or add the device to a botnet.

Advertisement. Scroll to continue reading.

Related: Android VPNs Introduce Security, Privacy Risks: Study

Related: No Patch for VPN Bypass Flaw Discovered in iOS

Related: Iranian Hackers Exploited Enterprise VPN Flaws in Major Campaign

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.