1

I received a notification from my firewall software that Shrewsoft's latest VPN client (version 2.2.2, released 2013-07-01) appears to be calling home. The ipseca.exe file included with the client is attempting to make an https connection from local port 63467 to remote port 443 at www.shrew.net (38.97.5.129).

Note that this connection request comes after starting the GUI VPN connection manager, but before attempting to open the VPN link.

Why would this be? Why would Shrewsoft's server need to be involved in establishing a VPN connection?

  • The version Ubuntu 14.04 bundles doesn't exhibit this behaviour. – r_3 Dec 16 '15 at 14:30
  • Update notification. – Fiasco Labs Feb 14 '16 at 20:34
2

The only logical reasons I can think of why software would do this is to determine if a newer version is available or if to see if the license is valid.

By intercepting the traffic with Fiddler or Burp Suite you should be able to determine why it is calling home and what kind of information is submitted.

Why would this be? Why would Shrewsoft's server need to be involved in establishing a VPN connection?

I doubt it is required to be involved in establishing a VPN connection, especially since you mentioned the connection is created when starting the application.

  • Thanks. I was just now trying OpenVPN as an alternative, and it too calls home (well, to a variety of Cloudflare servers). Once again, before a connection is established. Interestingly, OpenVPN seems to use hard-coded IP addresses rather than relying on DNS. For those interested, the two IP/ports I've seen are 104.28.1.12:65410 and 141.101.112.186 – EBlake Nov 16 '15 at 9:16
1

Phoning home is often necessary

VPNs need to phone home to ensure your username and password are valid. They also need to phone home as part of an update process to circumvent government censorship. In the case of Shrew Soft, they are offering a service that requires licenses.

All VPNs phone home. And in this particular case, it's probably checking for updates... many VPNs need to do this if you live in a country that's hostile to internet freedom, such as one that will remain unnamed. I'll give you a very subtle hint though: name starts with "People's Republic of", and ends with "China."


Does Shrew Soft offer any actual privacy?

However... I just visited ShrewSoft's website, and there are 0 results for the following keywords:

I even searched the rest of their website and didn't find any mention of those.

Why would you expect to be private on a VPN service that does not at all mention these words? In fact, if you were to search for "private", it only mentions private IP addresses, which isn't the same as offering privacy of any kind.

  • I think by 'phoning home' the OP is referring to sending data to Shrew Soft, not to the target VPN network which would be where the user/pass would matter. (I'd be very worried if the user/pass went to Shrew Soft! ;-) ) – Luke Usherwood Oct 12 '17 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.