5

I would like to make this story as short as possible since my question is not that long, I have worked with journalists previously in war zone where we investigated the involvement of EU IT companies in selling monitoring software to Dictator regimes owned ISP companies, One was a french company that I can't mention their name nor their software but the software was capable of simply monitoring anything from clients PCs even if it was encrypted.. it would be decrypted.

So my question is in case of being connected to VPN with SSL support and Certificate server/client verification plus user authentication. how secure can user's browsing be?

Is it possible for the ISP company that user is connected to, to know what anyone is browsing regardless if he/she is connected to a secured VPN connection?

migrated from security.meta.stackexchange.com Aug 29 '14 at 9:31

This question came from our discussion, support, and feature requests site for information security professionals.

10

Connecting to VPN and using the Internet in the scenario you described is actually very secure. In the case you're talking about (mutual authentication), it is safe to say that ISPs aren't able to intercept and eavesdrop on the connection to know what the user is doing.

However, in the example you made about war situations, government agencies don't just rely on ISPs intercepting connections. An example with which I'm quite familiar is the Syrian civil war. Regime agencies, supported by Russian and Chinese tech and advisers, have actively tried much more invasive methods.

Kaspersky has published a report detailing those invasive methods. They include malware disguised to look as if it contains important information to press or opposition (wanted activists names, lists of imprisoned members of the press, etc.), web pages serving malicious code, documents containing exploits, and a number of other methods. They mostly rely on social engineering.

To put in one line: Yes, that VPN scenario sounds pretty secure. However, in a broader context, only taking care of VPN will not guarantee you the security you're looking for.

  • Another, important, point is to make sure that all traffic is using the VPN. If you're making DNS calls over the unencrypted internet connection, you may be leaking data. – Chris Murray Aug 29 '14 at 10:58
  • You should add a word about the most typical attack performed by government against encrpyted connections: MITM attacks using forged certificates. – Stephane Aug 29 '14 at 12:38
  • Thanks a lot everyone for the great comments and answers. I have one last question, does the certificate's bit length affect in anyway the security of the vpn's connection ? if it's 2048 or higher, I know that 1024 is no longer supported and secure so I'm assuming that the higher the length the better? – Moh Aug 29 '14 at 16:28
  • Another aspect one should mention is that a VPN is only as secure as the VPN provider. A government can use a VPN provider to deanonymize their users through court orders, bribery or hacking them. – Philipp Jan 14 '15 at 11:55
0

Just because the point-to-point VPN (OpenVPN, IPsec, etc) is secure, does not mean the hosts behind each VPN endpoint are safe. Yes, VPN are rock solid when configuration is right. Yes, hosts on either side are easy, comparatively speaking, and in a wartime situation you will attack the weakest link. If you run microsoft on either side of the tunnel, both sides become compromised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.