1

Commercial VPN services are gaining a lot of popularity and some of them are heavily advertising their products on social media networks and technology magazines today.

The advantages of using such a service could be privacy from ISPs and additional protection from man-in-the-middle attacks when connecting mobile devices to obscure networks, if no own private server to tunnel the connection to is available to the user.

But what are the risks involved in using such a service?

It's recommended to research and find a trustworthy VPN service, if needed. What could happen, if the service provider acts against their users? (Because of malicious intent or a security breach)

In a similar question, it was mentioned that the VPN service provider could be monitoring the users' traffic, instead of their ISP, but the question was more directed toward the outward appearance of the user by connecting to a VPN in general.

What additional security risks could a commercial VPN service potentially introduce, compared to using a direct connection to the target server?

Sub questions:

  • Could the VPN provider supply manipulated websites to the user? Would HTTPS protect from this?
  • Can the VPN connection potentially work both ways, as in: The provider gaining access to home networks? (When using OpenVPN or proprietary client software)
  • Can the customer information be falsified and lead to incorrect incrimination on basis of the illegal activity of another user with shared server resources? Or even fabricated evidence?

Are there other risks involved?

3

Broadly speaking, using a VPN does not eliminate all risk, it is about shifting the risk (perceived or real) from your ISP to the VPN.

People have different reasons for using a VPN like:

  • evading government surveillance
  • becoming more 'anonymous'
  • accessing geographically restricted content (streaming, movies)
  • protecting themselves against rogue access points when on the move

Depending on what you are trying to achieve a VPN can be a solution... or not.

The worst risk imo is that the VPN will often turn out to be useless and will not help you achieve your goals. I am not going to cover all possible scenarios but suffice it to say configuration errors are very common, at least client-side like:

  • leaking DNS requests
  • leaking IPv6 traffic

Or:

  • disconnections

If you are looking to 'cloak' your traffic from the authorities then the plan is not being fruitful. And most people don't have the technical skills to thoroughly assess their VPN setup.

It's recommended to research and find a trustworthy VPN service, if needed. What could happen, if the service provider acts against their users? (Because of malicious intent or a security breach)

We should first define the meaning of 'trustworthy', because everyone probably has different expectations. Some people must think that a trustworthy VPN service is on that will never cooperate with authorities, even if you engage in highly illegal activity. The second aspect is how do we assess trustworthiness. I would guess: based on their track record, except that you won't hear so often about people indicted thanks to cooperation from their VPN service (but it happens).

You usually don't know the people running the VPN service so why would you blindly trust strangers with your Internet traffic ? Providers of VPN service talk a lot about privacy and make often misleading claims about 'not logging traffic', but there is no way to verify those claims.

If you are paranoid you can set up your own VPN service, cheaply. All it takes is a decent VPS. But that does not solve the confidentiality problem completely. The webhost could be monitoring (or logging) your activity. At least you have full control and you can configure it the way you want. But you become less anonymous too (because your Internet activity is tied to a static IP address). Again, it depends on your goals.

Can the VPN connection potentially work both ways, as in: The provider gaining access to home networks? (When using OpenVPN or proprietary client software)

This is an interesting question. A VPN is a network tunnel so it works both ways. The provider has to segregate traffic and isolate the activity of clients. As for yourself, you should have a firewall on your computer. The other end of the tunnel can probe your computer. If the VPN is misconfigured (lack of isolation) it is conceivable that others on the same network segment could also probe you.


There are some other risks, that are not technical but practical. Many websites block VPN outright or flag their users as potentially high-risk clients (they assume you have something to hide). If you order some stuff you may be subject to increased scrutiny because of your IP address. Your credit card payment could fail become you appear to come from another country. At times you will be asked to justify yourself.

Keep in mind that the IP address ranges of popular services are usually well-known - lists exist. Since you are sharing IP addresses with other people you can also be affected by the bad actions of other people. Imagine that you are ordering stuff from some site, and another person defrauded them, using the same VPN, possibly the very same IP address. What the vendor thinks: you are the scammer and you're trying to pull another scam. You: trying to prove your innocence.

Worse, if you had an existing account in good standing it could be jeopardized/tainted because of that fateful connection made using a third-party VPN service.

In 2020 algorithms make decisions, risk assessment is computer-driven and humans are not always in the loop to endorse decisions. There is no such thing as automated justice. On the other hand automated discrimination does scale pretty well.

| improve this answer | |
1

Could the VPN provider supply manipulated websites to the user?

Yes, since it is effectively a man in the middle.

Would HTTPS protect from this?

Yes, but only if the client really makes sure that HTTPS is actually used and that it is actually the expected site. The VPN provider could use mechanism similar to sslstrip to rewrite plain HTTP traffic so that it will never use HTTPS in the first place or that it will use HTTPS only with sites controlled by the VPN provider (and issue appropriate redirects), i.e. something like https://ebay.com.example.com instead of https://ebay.com.

Can the VPN connection potentially work both ways, as in: The provider gaining access to home networks? (When using OpenVPN or proprietary client software)

If you use a third-party software for the VPN it can essentially do anything with your computer, including providing the VPN provider a path in your local network. That's actually not only true for VPN software but also for browsers, office programs etc. When using VPN software which is not provided by the VPN provider the risk is lower but can still be there for example due to a bad configuration offered by the VPN provider.

Can the customer information be falsified and lead to incorrect incrimination on basis of the illegal activity of another user with shared server resources? Or even fabricated evidence?

Since the traffic can be manipulated information can be falsified. As for how this can be used legally is not a technical problem, it is more who is believed at the end. Such legal aspects are better asked at Law.

In summary: The trust relationship you currently have with your ISP essentially moves to the VPN provider. And if you install third-party software and/or configuration to access the VPN there is an additional trust relationship to this third party (which might be the VPN provider too, i.e. even more trust needed here).

| improve this answer | |
  • 1
    Hi Steffen, thanks for your answer. I know this was technically not exactly part of the question(s), but could you elaborate on how likely/complex such attacks would be to execute? The website manipulation/HTTPS-scenario is pretty clear to me. It would seem easy to perform, but wouldn't a common browser notice a problem with the certificate? Sure, the user has to be cautious, but that's always the case. How trivial would it be to gain access to my network with a prepared OpenVPN-config? I'd imagine that needing heavy/obvious modification? Just to put things into perspective. – Prototype700 May 24 at 16:15
  • @Prototype700: Technically these attacks are not hard to do. But of course users will notice eventually that something is wrong and the more users are affected the faster they will notice. But targeted attacks against a few users might be more feasible. This also means that the likelihood depends on how interesting you are as a target. As for OpenVPN - it is actually designed with connecting whole networks in mind (i.e. site to site VPN) so the ability to do so is built in and not hard to use. – Steffen Ullrich May 24 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.