3

This might be common sense but I just can't seem to get it. I purchased a vpn subscription for security ( I travel a lot therefore I am dependent of public wifi networks ). I have configured all the settings to connect automatically.

Allow me to take you on the usual flow of connecting to my public library's wifi:

I turn on my laptop (windows 10). I see on my log in screen (bottom right corner) that the laptop has already connected to the wifi network. I type my password, I log in to windows and the vpn desktop app takes a few seconds to open and connect.

What I am asking is : During the time ( around 30 seconds ) the computer is booting, logging in, turning on the vpn desktop app, actually connecting to the vpn, is my laptop exposed? I don't do anything until the vpn connects. The only thing that might happen is windows starting to download updates in the background.

Am I being paranoid or is this a legitimate concern? Thank you very much!

  • Great question! I suspect the answer is "any apps that initiate web traffic before the VPN is established could be vulnerable to MitM or traffic analysis", and so will depend on what background apps you have running, and whether they use HTTPS to phone home. I wonder if you can do routing / gateway hacks to Windows like hardcoding your VPN's gateway so that pre-VPN traffic will fail to find a route. Great question! I look forward to answers. – Mike Ounsworth Jan 10 at 21:44
  • This answer suggests that some VPN clients have an option for blocking network access until the VPN is established or if it gets disrupted. – Mike Ounsworth Jan 10 at 21:51
2

First, let's just take a moment to appreciate the tin foil hats. Everyone has them, we just put them to different uses. As a security architect, I cherish mine for both the safety it provides and the bountiful feast it helps me supply for my family. Thank you, tin foil hats.

Your question is legitimate. Your concern is legitimate. So that's a good start. Let's start digging into why the question and concern are legitimate and discuss simple things you can do to analyze what's occurring on your machine to ensure you're not broadcasting anything you don't want to be.

VPN as a method of privacy on an encrypted network is great for ensuring that no one can eaves drop on the conversation. The tunnel provides encrypted security when there isn't one natively on the network to begin with. Since you stated that you travel a lot, it makes sense that you would want this peace of mind especially when travelling around the globe. There are some sketchy places out there not to mention shady ISPs and routers providing access for malicious purposes (eg. Evil twin attacks).

Now, when your machine boots up, it will load your core services and essential applications and any other non essential applications you may have chosen. These could be slack or email or a number of other services that you have used on your machine. If any of these services leverage a network protocol that is not secure (ie. HTTPS or IMAP/POP/SMTP w/o TLS) then you may have an oops moment.

Since most services start the back and forth with authentication, that means that any of these applications running at start up are attempting to authenticate to a remote service. This may mean that you are transmitting a password and username in the clear even though you didn't want/intend do (and again is largely dependent on the type of protocol the application is running). Ideally, you would not transmit any of this data before your VPN session is fully established.

So there is the risk, what can you do about it?

  1. Look at your start up application lists. If there is anything you don't need to launch right away, remove it from the start up lists and launch it when you feel safe in your network environment. If you have multiple apps you wish to start at once, you could try building a simple start up script that you can execute at your leisure.

  2. Determine if your VPN client permits the blocking of network communication before a tunnel is created. This restricts your application clients from reaching out before your network tunnel is established. A good way to keep your start up applications managed by the OS too.

NOTE: This may have adverse effects if you want to present inside of another company, as an example. I know companies I have worked for explicitly prevent VPN tunnel connections from any guest networks, which would be a set back if you needed internet hosted materials.

  1. Ensure that you are using VPN only and not running in split tunnel mode. Split Tunnel Mode will allow your applications to bypass your VPN Tunnel to communicate. This is definitely a feature of some clients that should be turned off.

And I just want to circle back to the paranoia. So long as your paranoia doesn't prevent you from functioning in your role, it's probably a good thing. Being aware of security and the risks you run into, especially when you're on the go, is a good thing. In fact, depending on your travel I would tell you that there are some countries where you should never bring a device that you care about and use. Stay aware, share the awareness, and keep yourself secure and in your own way you're helping to make the internet a safer place.

  • That last point needs a big mention. You will be nearly powerless against a nation-state opposition as a visitor. You need to know which countries will jail you for espionage; so don't bring your valued tech in there. Don't think these are "third world" countries either. – Nelson Jan 11 at 1:23
  • The only automatic process that happens is windows updating. Do you know if those updates could be compromised if downloaded over an unsecured network? Moreover, I find it baffling that in 2019 we might still have desktop applications or services that do not encrypt their connection. How is that possible? – Clark Kent Jan 11 at 6:25
0

You are not paranoid. Your question is fully relevant.

Yes your laptop is exposed, and this stands true with any kind of VPN you are using.

To start a VPN you need a working connection from your PC to the Internet. I will name this connection the basal connection, and it is unencrypted.

This connection can be used by trafic exiting or entering your PC until the VPN is built and provide the encrypted connection on top of the basal one. Then, depending on your VPN functions, your VPN might configure back the routing from your PC in such a way that all the traffic will be forced to pass through the encrypted tunnel and the original connection (the unencryted basal one) will be blocked from your PC and the outside (the other end of the encrypted tunnel).

If your VPN provides a function named `split-tunneling (this function provides the possibility to maintain the basal unencrypted connection for some destinations and the encrypted one for all others) then the basal connection will always stay usable and let you exposed to direct attacks and data leak coming from a potential malware on your PC.

  • Can you comment on this answer that suggests that some VPN clients have an option for blocking network access (other than to the VPN server I suppose) until the VPN is established or in the case where it gets disrupted? – Mike Ounsworth Jan 11 at 13:56
  • This blocking of the basal unencrypted connection is established first with some software, but only by the VPN software. Before this software is started automatically within the user session, the basal unencrypted connection is active and used. You can analyze this film which lasts between 30s and 2 minutes by running a tcpdump on the Internet router or another machine on the proximal network (you will see a lot of 53/udp, 80/tcp, 443/tcp, 139/tcp, 445/tcp, 500/udp and then */esp or 10000/tcp). – daniel Azuelos Jan 11 at 18:35
  • 1
    I think I figured a way to prevent any basal unencrypted connection: Turn off automatic wifi connection, when booting the pc you will be offline. While offline, turn on the vpn client .. it will keep trying to connect but won't (obviously ) because the pc is offline. While the vpn keeps trying to connect, I switch on the wifi. The wifi connects and a fraction of a second later so does the vpn. What are your thoughts on this method? – Clark Kent Jan 11 at 19:45
  • Nice schedule 👌🏻 if your VPN doesn’t exit on error because the connection is down. To be tested. – daniel Azuelos Jan 12 at 0:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.