0

Update:

Check the VyprVPN's app developer answer below, seems this is okay and an uninstaller is added to new versions to prevent such issues.

Original:

I was working with VyprVpn a few months ago, never worked with them again,

Today I installed LittleSnitch (An OS X Firewall and Network Monitor),

Noticing The Issue

I noticed weird outgoing data to domains like: goldenfrog.com, dl.succentric.com , dl.bondwidth.org , dl.4titude.net , dl.trajectore.com etc Every few seconds...

There is no mention of this kind of activity on their website, they didn't come clear, also the support staff seems to be unaware

Then i get Whois for these domains, all registered at Tucows and have DNS *.DATAFOUNDRY.COM

But Goldenfrog is registered with valid information and the others are all protected whois for privacy...

Unistalling

Then i uninstalled VyprVPN Application with AppCleaner which looks for every related file and folder and deletes them too.

Even after uninstall

Outgoing traffic to all these domains was still happening every few seconds,

Please note there was no process with the name of Vypr... or Goldenfrog... in the Activity Monitor

I searched a lot and also used sudo launchctl unload /Library/PrivilegedHelperTools/vyprvpnservice to unload their helper, put the loader in trash, restarted and emptied the trash

And finally it wasn't happening anymore

Questions

  1. Is this kind of activity normal in VPN providers? they are legally registered company, claim that respect privacy...

  2. Are they allowed to send such data without letting us know about it when ordering, or without doing it with a process named under themself?

  3. Overall would you use their service after this? no other service is doing such thing

I'm asking because i want to be sure and alert my friends to stop using Vypr because its dangerous

closed as off-topic by Lucas Kauffman, Mark, Stephane, Xander, schroeder May 19 '15 at 3:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Lucas Kauffman, Mark, Stephane, Xander, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

1

Is this kind of activity normal in VPN providers? they are legally registered company, claim that respect privacy...

That the domain names begin on dl. (short for "download") sounds like they are checking for updates, configuration files or whatever. That they do it every seconds seems like a waste with Resources, but I Think they do it that way instead of having lots of support requests "I changed X in my account, why wont it work" or "I recently renewed my account, why it cannot connect?", and support would have to answer all the time "You need to wait X hours Before Changes take effect".

Instead they just did so it poll the server each few seconds, polling for updates and config files, so Changes instantly take effect.

However, such data does not have any privacy implications. Remember that VyprVPN do have access to your normal IP via the normal VPN server, so if they also have access to it via their dl. domains do not make any difference. And if they would want to secretly steal data from you, they could easily do this by padding unused space in your normal packets with their data they want to steal, and have the VPN server strip off the stolen data, making it impossible to detect.

So if they wanted to be malicious, they could be, without doing these dl. Connections at all.

Are they allowed to send such data without letting us know about it when ordering, or without doing it with a process named under themself?

Yes. They propably don't send anything else than your username and possibility some authorization token, hashed password or whatever, to be able to fetch VPN configuration files and application updates.

Overall would you use their service after this? no other service is doing such thing

As I said, those Connections are not dangerous. ALL vpn providers can steal data from you, WITHOUT making these Connections. They could easily hide the data they want to steal inside your normal packets that you send during web surfing and such, and you would have no way of detecting it, becvause the packets are encrypted with their public key.

All VPN providers who use a application to connect instead of setting up a Connection with a plain version of OpenVPN or PPTP, has the possibility to do dangerous things. But the "application" approach is simply to make it easy for newbies that don't want to fumble with OpenVPN keys and configuration files, or PPTP configuration settings.

  • Thank you, the fact that VPN "was not running"/"was uninstalled" and my account was expired for +1 month and they still did that was a little suspicious (the dl.* part could be for distraction too), to hide data inside my normal packets, they would need me to USE their VPN, so i thought maybe they have a backdoor/second way for those who don't connect but have the app installed, seems you are right, i just don't understand why they don't come clear with this and just mention it, why domains Whoises are protected etc, anyway, i needed to hear professional people opinion like you, thanks – Ara May 18 '15 at 8:09
  • 1
    I guess they just have their software poll incase you renew your account. Even if they would have a poll time of once per hour, if you renewed your account when it just have polled, you would be forced to wait a hour. So only way to ensure Changes take effect instantly, is to poll each few seconds. As you know, when using the polling scheme, theres no way for the site to "tell" your client that theres is updates, other than to send that at the next client poll. – sebastian nielsen May 18 '15 at 13:35
  • 1
    That they use different domain names like dl.bondwith.com and dl.trajectory.com could be that VyprVPN is either buying their service from a VPN reseller package (like "White label" VPN) that they then can put their own name on, or it is the opposite, that VyprVPN is Selling their VPN service to other VPN providers to resell. That thing could also explain the WHOIS protection on all domain names, since the Company purchasing the VPN reseller package don't want to "display" advertisement for the Company that they buy from, app need to check with all providers since it don't know which you have. – sebastian nielsen May 18 '15 at 13:42
3

Hi I'm the developer who wrote VyprVPN for Mac. It looks like you've still got one of our software components installed. Macintosh applications that needs to alter your system, including VyprVPN, uses something called a "privileged helper tool” aka a system daemon. We install a helper tool with the user's permission, using the appropriate Apple API for this purpose, that runs in the background and does things like setup the VPN, manage kill switch rules, etc. This is the component that is performing the operations you are seeing.

In recent versions of our software, we include an Uninstaller on the .dmg. Mount the .dmg and scroll down and you'll find an app called "Uninstall VyprVPN.app". Run that. It will remove the privileged helper tool.

  • Thank you Brant, i understand now, i don't know if it's better to remove this question to avoid any possible damage to their reputation? or keep it for other users with same issue – Ara May 18 '15 at 17:04
  • 1
    Hi Ara. I'm so glad that I was able to address what you wanted to know. I also really appreciate your writing about us and our app. I think its probably best to leave this up in the event someone else might have a similar question or concern. – brant May 19 '15 at 19:02
  • Thanks @brant. But after a lot of Googling this is the only reference to this info I can find. Something in the FAQ on the Goldenfrog website would be awesome. – Damon Maria Jun 21 '17 at 11:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.