0

I was asked by the college to install Sophos SSL VPN Client on my personal laptop to connect to the college network from home (to carry out tasks like course registration, etc.). I had already installed the client and used it multiple times.

Does my college have access to my private data when:

  1. the VPN client software is in connected mode? (connected to the college network)

  2. the VPN client is in disconnected mode?

If yes, what kind of data does the college have access to?

and,

How can I protect my privacy if uninstalling this software is not an option?

1
  • Welcome to the community. According to my knowledge, the software in question is proprietary, hence the assumption would be that when the VPN is disconnected it should not monitor you Commented Mar 15 at 18:13

3 Answers 3

2

The college has access to the plaintext data you send over the VPN. This could include, for example, website data (if the site uses plaintext HTTP) or the domains you're accessing (if the VPN assigns a new DNS server which is either operated by the college or uses plaintext DNS).

If the VPN client is disconnected, nothing gets sent over the VPN -- unless you think the client is actually malware, in which case you should remove it immediately.

To avoid sending data over the VPN unintentionally, you can do the following:

  • If you want to be absolutely sure, remove the VPN server as the default gateway and instead manually create routes for specific IP addresses or subnets which should be accessed over the VPN (e.g., college websites). Note this can be a lot of trial-and-error depending on the complexity of the network infrastructure.
  • Make sure you're using your own DNS server instead of the VPN-provided one.
  • Use encrypted protocols whenever possible, e.g., HTTPS instead of HTTP, and DNS-over-TLS or DNS-over-HTTPS instead of DNS.
2

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/RemoteAccessVPN/VPNSophosConnectClient/index.html makes it sound like the Sophos SSL VPN is just OpenVPN with lipstick, to the point that they even say to just use the OpenVPN client on platforms they don't support. OpenVPN is trustworthy (and open-source, so you could verify it even if you didn't trust it), so you should use it instead even if you're on a platform Sophos does support. Just make sure you look through your school's .ovpn file carefully, because they have a lot of power.

0

I would say the risk is pretty low. But since installing any software, especially one which requires administrator privileges in order to create a VPN tunnel carries some risk, you could create a virtual machine and put it there. VirtualBox is probably the most user-friendly tool to get the job done.

Also, openconnect is an open-source replacement for various commercial VPN solutions. It's a VPN client. I use it extensively during penetration testing engagements so I can minimize the risk of installing VPN software which will force all my traffic through the VPN gateway and run with root privileges as another, potentially vulnerable process.

https://github.com/openconnect

it even has a GUI.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .