VPN With 'Strict No-Logs Policy' Exposed Millions of User Log Files
'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks. Contained within the database were more than 20 million logs including user passwords stored in plain text. User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all." A total of 894GB of data was exposed, and the API access records and user logs included: Account passwords in plain text; VPN session secrets and tokens; IP addresses of both user devices and the VPN servers they connected to; Connection timestamps; Geo-tags; Device and OS characteristics; and URLs that appear to be domains from which advertisements are injected into free users' web browsers. Comparitech notes that this runs counter to UFO VPN's privacy policy.' -- source: https://it.slashdot.org/story/20/07/17/2338230 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/
Enough metadata there to get any intelligence professional salivating. A very worrying covert betrayal of the "no logs" pitch. Goes to show we should never trust any marketing claims that can't be independently verified. On 19/07/20 11:59 am, Peter Reutemann wrote:
'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks. Contained within the database were more than 20 million logs including user passwords stored in plain text. User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all."
A total of 894GB of data was exposed, and the API access records and user logs included: Account passwords in plain text; VPN session secrets and tokens; IP addresses of both user devices and the VPN servers they connected to; Connection timestamps; Geo-tags; Device and OS characteristics; and URLs that appear to be domains from which advertisements are injected into free users' web browsers. Comparitech notes that this runs counter to UFO VPN's privacy policy.'
-- source: https://it.slashdot.org/story/20/07/17/2338230
Cheers, Peter
On Sun, 19 Jul 2020 11:59:55 +1200, Peter Reutemann quoted:
'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks.'
Not just UFO VPN. A total of seven VPN providers were similarly exposed. What did they have in common? They were all actually resellers of the same “white-labelled” VPN service, which seems to be from a company called “Dreamfii HK Limited” <https://www.theregister.com/2020/07/17/ufo_vpn_database/>. So while it may be true that none of the resellers was keeping logs, that didn’t apply to the actual provider of the service.
Good point Lawrence. It's similar to the practice of some VoIP trunk wholesalers keeping recordings of all calls without the knowledge or consent of their resellers or retailers. On 19/07/20 12:31 pm, Lawrence D'Oliveiro wrote:
On Sun, 19 Jul 2020 11:59:55 +1200, Peter Reutemann quoted:
'An unprotected database belonging to the VPN service UFO VPN was exposed online for more than two weeks.' Not just UFO VPN. A total of seven VPN providers were similarly exposed.
What did they have in common? They were all actually resellers of the same “white-labelled” VPN service, which seems to be from a company called “Dreamfii HK Limited” <https://www.theregister.com/2020/07/17/ufo_vpn_database/>.
So while it may be true that none of the resellers was keeping logs, that didn’t apply to the actual provider of the service. _______________________________________________ wlug mailing list -- wlug(a)list.waikato.ac.nz | To unsubscribe send an email to wlug-leave(a)list.waikato.ac.nz Unsubscribe: https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz
participants (3)
-
David McNab -
Lawrence D'Oliveiro -
Peter Reutemann