0

I am running on Windows 7, version pro.

I have just started paying for the vpn service ExpressVPN. From that point, I noticed that ExpressVPN software was running a nssm.exe process (non-sucking service manager), which itself was running a xvpnd.exe process. (I am using Process Explorer to monitor processes on my PC).

ExpressVPN running xvpnd.exe process via nssm.exe

When looking at xvpnd.exe properties, tab TC/IP in Process Explorer, a protocol linked to www.taboola.com:0 is listed in the state "LISTENING".

enter image description here

Taboola!? Isn't it a tracking website?!

Reading their Privacy Policy ExpressVPN seem to care about privacy ("We are committed to your privacy and do not collect or log traffic data or browsing activity from individual users connected to our VPN."), but still warn that they can send "diagnostic" data to third parties and that they use "website analytics tools" to "track sales promotions or advertisements and to understand which pages on the Site receive visitors"... But I am not sure I properly understand the jargon though...

My question : would someone know if this feature could still be harmless (to my privacy) or if I should just ditch ExpressVPN immediately for spying on their clients despite their commitments?

Improve this question
6

I work for ExpressVPN and have investigated this issue. Here are our findings:

  1. No, there is NO link between ExpressVPN and Taboola. I believe what you’re seeing in the screenshot is a case of mistaken identities. Here’s one sign that something is wrong in the screenshot: the ‘remote address’ for a listening socket in process explorer should always be shown as ‘0.0.0.0’, yet somehow your machine resolves that as taboola.com, which doesn’t make sense to me.

  2. What actually happens: xvpnd.exe is an ExpressVPN process that controls the VPN. It listens on 127.0.0.1 (meaning just on the local machine) for messages from the ExpressVPN UI application, expressvpn.exe.

  3. My theory on what caused your machine to resolve 0.0.0.0 as taboola: there might be software on your computer, maybe ad-blocking software, that modified your hosts file and added an entry for 0.0.0.0 pointing to taboola.com. It might have done that in an attempt to block all attempts by your machine to connect to that domain.

One unfortunate side-effect is that the process explorer you’re using now resolves 0.0.0.0 as taboola.com.

Here are some ways to confirm my theory:

  1. on your local machine, run a traceroute to 0.0.0.0 (tracert 0.0.0.0). Does it show taboola?

  2. check your hosts file (ie: C:\Windows\System32\drivers\etc\hosts). Does it have an entry for taboola?

There are probably other explanations as well. I’d appreciate if you got in touch with us at https://www.expressvpn.com/contact and mention that you’re referring to this post. We can work together to figure out what happened on your machine.

The important take-away, however, is that the ExpressVPN app is NOT doing anything malicious, and has no connection with that domain you saw listed. We take your privacy very seriously.

Improve this answer
  • Thanks for your reply. As you suggested, I did find that this was coming from the local host file (imported from winhelp2002.mvps.org/hosts.htm, then modified) which was associating taboola to IP 0.0.0.0 (in order to block unwanted connections to the ad-site). – Janthelme May 19 '15 at 3:05
  • Thanks Jean, we're glad that we could clear this up for you. To re-iterate, there is absolutely no link between ExpressVPN and Taboola, the app is not doing anything malicious and we take your privacy incredibly seriously. – David Lang May 20 '15 at 3:56
-1

NSSM is also coming up on 6 hits on virus total currently. Perhaps Express VPN should consider using a safer alternative that does not pose such a high factor as risk-ware!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.