How easy is it for hackers to intercept http traffic between VPN exitnode and the destination web service without being inside the VPN or web server?

Question

Let’s say I’m using http connection over a properly set up VPN with secure protocol and implementation. Then, most likely, the connection will be secure all the way until it exits the VPN server.

But since the traffic is unencrypted, sensitive information is at risk if it’s intercepted after that point. I’m curious how easy it is to intercept it.

As far as I know, the hacker should be inside the VPN endpoint or at the destination itself, meaning the VPN server or the website itself are already compromised, like the case of tor sniffing where the exit nodes are owned by malicious actors themselves.

If that’s the only most viable way, then, although there are still far more risks than TLS/Https, it doesn’t seem to be that extremely dangerous to access a http website over a trusted VPN.

(I’m aware of rarer cases like BGP hijacking.)

Answer 1

The connection would need to be intercepted between the exit point and the http web server.

With the VPN, your exit point it the VPN exit IP. If you don't use a VPN, the exit point is your own computer.

The VPN (which we consider secure here) alters the topology by bridging two points, but you still need to trust an internet provide.

If the VPN exit is in Brazil, the website in Ireland and you are inChina, you probably trust more the connection Brazil -> Ireland than the China -> Ireland one (even though the transoceanic cables are likely tapped).

On the other hand, if you were instead in the Netherlands, the route Netherlands -> Ireland is probably less risky than Brazil -> Ireland. Not only there is a significantly shorter distance, but the legislation is much more harmonized in the latter.

But in the end, it's just a matter of which of the providers you trust more.

Note: in reality, it's not only the internet provider of your exit point, but all the intermediate networks between them and the destination.

Answer 2

You're only considering the possibility of an attacker sniffing the data. However TLS provides for more than just encryption, it validates the end point. If an attacker knows where the VPN exit node is, and what you trying to connect to, then, in theory, it can bombard the exit node with fake DNS replies to trick the exit node into sending the elsewhere.