I use VPNs all the time on my iPhone to get around websites being blocked and sometimes just for privacy, but are they secure?

In this video the guy installed a certificate on the lady's phone that contained some VPN settings and just from that he could log keystrokes from HTTPS websites, view her screen, type on her phone, and do a lot more. How is this possible?

  • Please add within your original question (OQ) what you did thus far to check the security of the VPN you use, since you use it. – dan Mar 18 '16 at 10:09
  • Asking questions on the form "Is X secure?" is not very popular here, please see this. But what you are really asking about is the very specific vulernability in the video. I would recommend to rephrase the question to be just about that with a edit. And welcome to Secuirty.SE! :-) – Anders Mar 18 '16 at 10:11

Absolutely. There are countless ways to compromise a VPN. VPNs were not designed for multiple mutually untrusted people to share the same system. This applies to all direct IP to IP technologies, including OpenVPN, IPSEC, GRE, MPLS, IPIP, and more. Using a variety of methods (lsrr, netbios probing, dns cache poisoning, etc), attackers can find your real IP address, force you to visit malicious websites by poisoning your DNS, fingerprinting your networking stack, potentially exploiting your networking stack, and more.

Do not use a commercial VPN for security or anonymity if you do not trust every single person who is using the same VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.