16 ms·

Swing VPN app is a DDoS botnet

723 points by campuscodi 3y ago

radicaldreamer 3y ago
VPNs in general tend to be super shady. Many vendors surreptitiously use user nodes as exit nodes and route traffic in suspect ways. VPN software stack is surely a major target for state and non-state actors to monitor and exploit.
- internetter 3y ago
  Hola VPN, for instance, is famous for using the extensions as "exit nodes"
- salad-tycoon 3y ago
  So does this mean then that if someone appears to be using my IP to do illegal thing x y z police/lawyers would come at me first? If so, would simply having an account and exe file be enough to argue “my wifi is open, I didn’t download all that XYZ!”
  - eddythompson80 3y ago
    By the time the police comes at you because of your home IP, they usually have collected a lot more evidence than that. That's why torrenting from your home without a VPN usually just results in a letter from your ISP saying "we know what you're doing. cut it out". No body has ever been convicted with their home IP as the only evidence.
    - greyface- 3y ago
      https://www.npr.org/sections/alltechconsidered/2016/04/04/472992023/when-a-dark-web-volunteer-gets-raided-by-the-police https://www.npr.org/sections/alltechconsidered/2016/04/04/47... Convicted? No. Raided? Yes.
      - eddythompson80 3y ago
        Of course, you get raided most likely once they have sufficient evidence that they'll be able to collect incriminating evidence. Your IP might be enough to get a warrant, but they'll need a lot more to build a case in court. Hence the raid, confiscation of servers, etc.
  - autoexec 3y ago
    https://www.cbsnews.com/news/unprotected-wi-fi-getting-owners-in-trouble/ https://www.cbsnews.com/news/unprotected-wi-fi-getting-owner...
- deleted 3y ago
  [deleted]
- jjbinx007 3y ago
  I think one major problem is VPNs are advertised or promoted as if they're synonymous with antivirus software. I partially blame the myriad YouTubers who happily push these to their fans to supposedly protect their privacy and protect their computers from harm.
  - gurchik 3y ago
    Until recently, eyeglass manufacturers were marketing blue light filtered lenses (which don't even filter much blue light anyway) as a way to prevent macular degeneration, until regulators shut it down. VPN providers shouldn't be allowed to claim that VPNs protect you from malware or that they do a better job at protecting data in transit than vanilla SSL.
    - kaplun 3y ago
      Hey, I have such glasses, and here in France at least they are still marketed. Do you have any reference pointing out the fact that they do not work? (Are they even worse than regular glasses?)
      - gurchik 3y ago
        > they are still marketed They're still marketed as a way to prevent macular degeneration?
    - KnobbleMcKnees 3y ago
      Any source on the blue light filtering not working? I didn't get the filter on my latest glasses and feel like my eyes fatigue more quickly, but I'm aware that could just be aging or a change in monitors, lighting, etc. which have occurred since my last subscription update.
      - gurchik 3y ago
        The lenses I'm talking about are the ones that are completely or nearly completely clear. Here's a photo of the "Everyday" blue light lenses on Zenni Optical as an example. They are marketed as blocking 16x more blue light than normal lenses. https://static.zennioptical.com/marketing/campaign/blokz/2023/LP/carousel/standard-lg.png https://static.zennioptical.com/marketing/campaign/blokz/202... How could it be blocking any significant amount of light in the visible spectrum and still be clear? I'm sure the "16x" claim is true, but normal lenses block a small amount of light. 16 times nearly zero is still nearly zero. It's just a marketing gimmick. Zenni Optical also sells lenses which are orange. I'm sure that actually does block a significant amount of blue light, but I also know from my experience visiting optician offices that many consumers are buying the first kind. I'm aware of studies which link blue light to eye fatigue and disruption of the circadian rhythm but I'm skeptical that blocking 5% of blue light or whatever could have a perceptible medical effect. With that being said, I don't feel strongly about claims like the 16x thing if its actually true (just a bit misleading). My comment above was mostly about the claims that they prevent macular degeneration which there is no evidence for. And regulators are right to jump in before it gets too bad, otherwise why stop at macular degeneration? Just say your lenses prevent hair loss and skin cancer while you're at it.
- jangxx 3y ago
  Does this also work if you're using the generic OpenVPN client to connect to the VPN? I've used a bunch of different VPN providers over the years, but they usually just offer an OpenVPN configuration that you can use with the normal client. I'm not aware of this also allowing them to send traffic the other way, but maybe it does?
  - lyu07282 3y ago
    afaik no that's impossible without modifications of the customers OpenVPN software itself (they would need firewall/iptable rules for NAT, impossible to set via OpenVPN config). That's exactly why it's a bad sign if a VPN provider doesn't just give you VPN configuration files.
account-5 3y ago
I love this sort of thing. I'd love to get into this sort of research. No idea where to start to either acquire the skills or once acquired target the right systems/apps. I can still dream though. Any pointers on where you'd start would be appreciated though.
- gremlinsinc 3y ago
  I'd literally start any training by asking chatGPT, probably using phind to ensure it's got more up to date info. I wouldn't trust everything it says, but it can help you maybe find your weaknesses on a topic and formulate a self education plan.
- raybb 3y ago
  I'd recommend watching liveoverflow on YouTube. He has great videos about reverse engineering programs and is very beginner friendly.
- jeroenhd 3y ago
  In this case, the whole process was just "let's see what my device is doing" and then digging until the unexplained is explained. Your devices are doing lots of weird things, talking to tracking servers, fetching data from unexpected places, you just need to take a look and start wondering! Running Wireshark or an equivalent smartphone app is easy. Understanding it probably a lot less so, but network protocols can be googled. One trick to not get overwhelmed too much is to not use the device you're analyzing too much so you only collect background traffic. Another is to filter out traffic you can't do much with. A lot of traffic is encrypted by TLS these days, but a lot of data is still visible, like in this case a random domain that you shouldn't be seeing. However, except for that very first TLS packet, you won't be able to see anything interesting in the rest of the stream, which can be gigabytes in size! The real challenge for network analysis is that 99% of the time, your network is not doing anything strange (or at least interesting). If you want to find something, you can try seeking out sketchy apps (free VPNs are a nice target, they're almost always shady) but there's no guarantee that you'll find anything. Or you can dive deeper if you think there's more to be found. In the case of Android apps, those are often easily decompiled into either VM byte code (smali) or even obfuscated Java code. apktool, jd-gui, or ghidra can usually get some kind of readable-ish code out of an app. There's also an excellent online APK decompiler if you trust that. Grabbing the APK is quite easy, you can find apps that do this or otherwise you can use Android's debugging tools to pull the app off your phone. Depending on how obfuscated your target is, complete reversing may be difficult. You can often take shortcuts, though, like looking for interesting strings or setting files. Another nice trick to employ when reversing applications is to run Frida. Frida is a toolkit for injecting arbitrary code into another process. You can either inject Frida into an APK you've downloaded, or if you've got a rooted device run it against any unmodified app. It works on other platforms as well! With Frida you can write Javascript in the Chrome dev tools to control the app, list objects and functions, call random APIs, whatever you need, all without decompiling. Another trick I like to employ is using mitmproxy to man-in-the-middle apps so you see every HTTPS call they make, the responses, and you can even mess with the traffic (change responses, alter requests, you name it). The tricky part is to get the app to accept your TLS interception, but there are Frida scripts that will disable validation of TLS certificates in all manner of apps, giving you the ability to inspect them. That last part can also be very useful if you're reverse engineering an API. I've written a blog post about a Norton VPN where I did exactly that, not because Norton was being shady, but because I wanted to use the OpenVPN config file on my laptop and they didn't provide me with the necessary files (even though they totally could have).
ctippett 3y ago
Excellent sleuthing! I sometimes use Proxyman to sniff the traffic that my phone or computer is using – it's fascinating seeing what and how different apps communicate with their backend servers. I haven't come across anything quite so nefarious, but its interesting all the same.
esafak 3y ago
Don't leave us hanging! Whodunit?
- eddythompson80 3y ago
  What do you mean? Swing VPN is a "free VPN" service that's actually operating a botnet. Swing VPN dunit.
  - CharlesW 3y ago
    Often, the VPN maker is different than the botnet provider. https://scrapestack.com/faq https://scrapestack.com/faq: Residential ("premium") proxies provide IP addresses that are connected to real residential addresses and devices, which makes them much less likely to get blocked while scraping the web. We highly recommend using residential proxies for your web scraping needs as they make it easy to work around geo-blocked content and harvest data at scale.
  - esafak 3y ago
    I doubt somebody started or paid a VPN to strike Turkmenistan Airlines for shits and giggles. I suspect there is more to the story.
    - sim7c00 3y ago
      its not clear its ddos, though it might be, as one commenter suggested it might be ad revenue or so. maybe they hit themselves? :D. i bet we will never know.
    - eddythompson80 3y ago
      No body starts a botnet to hit one target. Botnets are usually for hire. You find a vulnerability, establish as many C&C devices as you can, then advertise online that you have a botnet capable of XYZ, and you get contracts to hit particular endpoints. In this example, Swing VPN is offering a "free VPN" service, but they actually pay for it with botnet contracts.
gurchik 3y ago
> After app startup, language selection and acceptance of privacy policy the app starts to figure out ‘real IP address’ by doing a request to both google and bing with query “what+is+my+ip”. My guess is that the app just parses the returned HTML and figures IP from those responses. Aren't there free APIs to get your IP address, like ifconfig.me? This sounds like more work but probably doesn't have any chance of running into rate limits.
- starttoaster 3y ago
  There are APIs, and in my opinion, just falling back to a different HTTP API would probably be easier than parsing HTML. Though I use one of those APIs for a dynamic DNS client I built, and I've never actually seen a rate limit on them, even if I'm calling them every minute. I appreciate you showing them the benefit of the doubt here, but in my opinion the more likely answer is just that the person who did this is just underinformed on the state of quality of life-improving public APIs.
  - nerdponx 3y ago
    It's also borderline trivial to set up your own on a VPS with Nginx.
    - LtdJorge 3y ago
      And leave traces?
- judge2020 3y ago
  Every cloudflare site responds with `ip=x.x.x.x` at /cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace
  - ignoramous 3y ago
    I often use cdn-cgi/trace endpoints to do latency measurements, sync time, geo-locate; real handy.
womitt 3y ago
Maybe not ddos just pushing up view counts for money
- pie2pie 3y ago
  [dead]
sim7c00 3y ago
nice findings, firstly, thanks for looking into it and sharing. i wonder how they have 3 million installbase. do you think there are some (unwitting) influencers, streamers etc. paid to promote this? 3 million is plenty, especially since there are a lot of heavily promoted vpns out there bidding for installs
pfooti 3y ago
So is hola vpn: https://www.theregister.com/2015/06/10/hola_gets_holes_poked_in_client_lulzsec/ https://www.theregister.com/2015/06/10/hola_gets_holes_poked... At this point one must assume that any "free" vpn software is free because it uses its install base for DDoS / other traffic abuse.
- moffkalast 3y ago
  Yeah, Nord is for example infamous for pimping out their users as scraping proxies: https://oxylabs.io/pricing/residential-proxy-pool https://oxylabs.io/pricing/residential-proxy-pool
  - jvanderbot 3y ago
    I don't know why, but I did not expect a completely public, normal looking pricing page for something this nefarious-seeming.
  - sim7c00 3y ago
    luminati.io, similar for hola. guess they rebranded now as that one redirects :p but its still the same. this should be illegal really...
  - KomoD 3y ago
    Nord as in NordVPN? Source in that case please?
    - moffkalast 3y ago
      https://www.techradar.com/news/judge-orders-mediation-after-jury-orders-oxylabs-to-pay-dollar75m-in-latest-episode-of-proxy-wars https://www.techradar.com/news/judge-orders-mediation-after-... http://web.archive.org/web/20191128170008/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 http://web.archive.org/web/20191128170008/https://medium.com... It's pretty well known.
      - KomoD 3y ago
throwaway8_56 3y ago
> we probably can assume that this app is trying to attack some government sites of Turkmenistan. It is hard for me to imagine why would anybody do that I find this very odd that they would target those websites. What would be the gain of taking down those websites _for anyone_. I doubt that the reason is political. P.S. Turkmenistan is probably the worst country when it comes to free internet. Almost all IP addresses are blocked, with very few websites (mostly google-owned) being reachable. The entire population is desperate for VPN (preferrably free). They are not educated about malwares, or anything about security, so they will download anything that promises free internet.
- dclowd9901 3y ago
  Couldn’t it just be old fashioned blackmail? Attack the site and request money to turn off the botnet? It might be a bad assumption on my part but it occurs to me that maybe Turkey doesn’t have a lot of pull to investigate cyberattacks across country lines so businesses in that country might be good targets to not get blowback?
  - throwaway8_56 3y ago
    Turkmenistan certainly has no capacity for investigating a cyber attack for sure. But they are have no problem with those websites being down. Internet usage in the country is very low, and those websites are down the most of the time anyway.
  - LtdJorge 3y ago
    Turkmenistan*
- RobotToaster 3y ago
  Turkmenistan is part of China's BRI, so it could be any state that wants to see that fail?
homero 3y ago
All free VPNs are malware
zidoo 3y ago
free vpn == click highjacking on affiliate networks. but botnets will work too.
pie2pie 3y ago
[dead]
thrdbndndn 3y ago
I'm not sure if it's appropriate to give unsolicited suggestions on the writing, but I believe the author could improve the conciseness. It reads a bit verbose in places where certain information is repeated multiple times, such as the mention of configurations were retrieved from GitHub and Google Drive sites.
- LordShredda 3y ago
  Writing technical articles is hard. They're usually research note dumps or technical jargon mixed in with some english words.
ghoshbishakh 3y ago
Installing a client always opens up these risks. That is why I am building a clientless tunneling service ( well technically you bring your own client ) - https://pinggy.io https://pinggy.io which is similar to ngrok but you can connect using your own ssh client such as openssh.
- lxgr 3y ago
  This article is about a VPN service. How does a clientless ngrok alternative help here (which tunnels server traffic), and why is it even necessary given that many OSes support at least one VPN protocol natively?
  - ghoshbishakh 3y ago
    I am saying this attack works only because a client is installed on the device, and that client is malicious. If there was a standard client such as openvpn client (open source) then this attack will not be possible. That is becasue, the vpn provider will not have any means of using the user's device to send arbitrary network packets to any server to launch a ddos.
- lionkor 3y ago
  Been a happy Mullvad.net customer for a while now, partially because it allows just grabbing a wireguard or openvln config, no client needed
sim7c00 3y ago
for ppl wanting a vpn which does not do this. at the monthly rate things like nord charge, u can rent a server, install openvpn amd be free of this stuff. ofcourse, the server is yours and tracible to you, but still it has all the other benefits which i think normal vpn users crave. (visit plaintext sites over insecure wifi but no eves on the line etc.). its fairly easy to set up and definitely you wont be part of a traffic redirection network, for whatever purposes the redirection is. maybe u can connect ur friends too and be a good samartian :)
- lxgr 3y ago
  > visit plaintext sites over insecure wifi but no eves on the line etc. Not a rhetorical question: When is the last time you’ve visited a non-HTTPs website? > you wont be part of a traffic redirection network These are also only a concern for HTTP. Other common use cases for VPNs include geo-unblocking, and hosting IP ranges are commonly blocked by streaming sites. I can’t think of a good reason to use a VPS for a VPN anymore these days, to be honest – the privacy/security landscape has changed dramatically over the last few years. You probably get better privacy these days on public (free/unauthenticated) Wi-Fi than you would on many "free" or paid VPN services.
  - fragmede 3y ago
    I don't get why people buy cars anymore when there's Lyft and Uber. The transportation landscape has changed dramatically over the last few years.
    - lxgr 3y ago
      Seems like you misread my comment as "there is no need for VPNs anymore these days". I'm merely saying that I don't see the use case for the "self-hosted VPN server" model anymore. Need to bypass geoblocking, e.g. when traveling? You'll likely need a residential IP -> use your own network at home (e.g. Tailscale or a self-setup solution) or one of the shady "residential IP broker" utilizing commercial VPNs out there. Want privacy (from visited sites' trackers)? Your VPS is definitely not that: The IP is static, and if you send your entire traffic through it, this is much more fingerprintable than even residential web usage. -> Use a commercial VPN that you can trust (I don't know many) or something like iCloud Private Relay or TOR. Want privacy from your ISP tracking you (including public Wi-Fis), and only that? Then, yes, a VPS-based VPN might be for you (or any of the commercial VPNs out there). But my claim is that the last one (and only that) is probably not the biggest concern of most people.
jsnell 3y ago
Great writeup! > I have to give props for Swing VPN teams creativity to bypass security measure of Apple appstore and Google PlayStore but it is sad that Apple/Google security systems does not have some automated ways to detect these types of actions. It's a tricky problem. The amount of attack traffic from an infected device is negligible and very little of it is visible to the operating system due to TLS. It's also presumably intermittent (there's no point in keeping an attack ongoing forever; you stop when the site has found a way to defend itself), so just running the app for a while as part of validating an update might not show any suspicious behavior. The suspicious part is in the configurations downloaded from the CnC servers, not packaged with the app, so static analysis won't help. The only reliable option for catching these proactively thatI can think of would be to use some kind of aggregate telemetry from all the app installations combined, but that'd be incredibly scary both in terms of privacy and the blast radius when something goes wrong. > Currently in the beginning of June 2023 it has over 5 million install base on android That's not really a reliable number. It's more like "the number of distinct users who had this app installed at some point". AFAIK it doesn't get decremented when somebody uninstalls the app, and doesn't go up when somebody installs it for a second time on a new device. Those factors might cancel out, might not.
- deleted 3y ago
  [deleted]
mike_hock 3y ago
> doing a request to both google and bing with query “what+is+my+ip”. My guess is that the app just parses the returned HTML and figures IP from those responses. lol
- Waterluvian 3y ago
  This is interesting. Does this make it harder to filter/blacklist once discovered? Or is this just incompetence? If I had a known user agent doing a curl to icanhazip or whatnot, could that eventually be blacklisted?
  - mike_hock 3y ago
    I don't get it. Where does the VPN traffic go through? If they can operate a gateway, then surely they can provide their own endpoints for IP discovery (and also C&C for that matter). Until it's discovered, traffic to their own servers would appear the most innocuous. After that, the app gets kicked off the store and the server doesn't matter. Unless it doesn't actually do any VPN and it's all just a farce, lol.
OJFord 3y ago
Yeah, this and countless others that nobody's ever heard of except through a YouTube advert making questionable claims with a questionable definition of 'VPN'. (To answer the inevitable: Mullvad and Proton are the legitimate offerings that spring to mind.)
badcarbine 3y ago
Written by AI
deleted 3y ago
[deleted]
dishsoap 3y ago
Hilarious conclusion from the author. It's almost certainly not the case that the owners of this service are using it to 'DDoS' targets, rather it's much more likely they are using your device to host a proxy server and then selling access to some 'residential proxy reseller'. On the other side of that, some random Joe has probably purchased access to a set of these 'residential proxies' and is using them to scrape flight data from the airline site the article author noticed, with some of those requests being sent over the author's connection. Many 'free vpn' and 'free proxy' apps engage in this behavior, you may proxy your requests via their connection, but they also proxy their requests via yours, generally reselling that access to someone who finds your IP address to be of value to them due to the fact that it's not a datacenter address. It's certainly questionable to straight up unethical either way, especially so if the service doesn't disclose to you that they're doing that, but on the other hand I find the author's DDoS conclusion to be so contrived and out of touch with reality that I had to write this comment.
- bibabaloo 3y ago
  Pretty harsh to say that this is a hilarious conclusion when your own conclusion seems even more rash. If your conclusion was the case, wouldn't that mean there'd also have to be people interested in scraping random (static) https://www.science.gov.tm/ https://www.science.gov.tm/ pages?
- aaronharnly 3y ago
  Did you read the part where there was a hosted, downloaded, config file that contained the target URLs? That doesn’t seem proxylike. "urlList": [ { "url": "https://turkmenistanairlines.tm/tm/flights/search?_token=J8SxUX2Qwzltw4LiHsRHTCtfthgBYxf4hyI8oNly&search_type=internal&departPort=TAZ&arrivalPort=CRZ&tripType=rt&departDate=4%2F22%2F2023&arrivalDate=5%2F4%2F2023&adult=1&child=0&infant=0&is_cship=on", "method": "GET" },
  - dandongus 3y ago
    My mistake, I looked at the article for 10 seconds before assuming that this app is no different than hundreds of other ones, apparently it is a rare outlier. At any rate, there are more effective ways to disrupt service if that was the goal.
klysm 3y ago
No free lunch
jongjong 3y ago
DoS should be legalized IMO... If a company cannot mitigate a DoS or DDoS attack and stay profitable, it's their own fault. Their fault for not designing their software properly and their fault for accumulating too many enemies. Probably it would bring down the whole DNS system but it's about time we replaced it with something better and more decentralized anyway. DDoS is just freedom of speech. Just some people have louder voices than others which is not a foreign concept to the rest of us. So long as the VPN (or whatever) operator mentions it in their terms of service (e.g. if they rely on user resources), it's fine IMO. There needs to be an incentive for companies to implement good quality software and to not be evil (not to make enemies) and legalizing DDoS might help create such an incentive.
- hn_acker 3y ago
  > DoS should be legalized IMO... If a company cannot mitigate a DoS or DDoS attack and stay profitable, it's their own fault. Their fault for not designing their software properly and their fault for accumulating too many enemies. Getting DoS-ed is sufficient "punishment" for not being able to mitigate a DoS. "their fault for accumulating too many enemies" is dubious considering that one "enemy" is enough for a DoS and that the DoS-er might not actually have something personal against the target. > DDoS is just freedom of speech. Just some people have louder voices than others which is not a foreign concept to the rest of us. I wouldn't characterize a DoS-er as "the one with the louder voice". I hope you don't think doxxing and revenge porn should be legal too. Anyway, there's the saying "My right to swing my fist ends where your nose begins."
  - jongjong 3y ago
    I see it differently and I have gained a different understanding of "My right to swing my fist ends where your nose begins." I used to think like that but in reality, the way the world really works is that anyone can punch you in the nose if they really want to... Whether or not the assailant will be punished for that depends on who got punched and who did the punching. Access to the justice system is asymmetrical. Big corporations or organizations are often not held liable for many of their 'crimes' on a per-infraction basis because their victims have a much weaker voice; they can basically do all the crimes they want and then, if they harm enough people and they get caught and there is a class action (a lot of IFs), they MAY pay a lump sum fine at the end. I prefer the ancient Roman system where some crimes were forgiven based on context (e.g. retaliation was allowed). I think it would bring back the human element to the justice system. People should be allowed to take the law into their own hands provided that their cause can be morally justified in front of a random sample of citizens.
paulryanrogers 3y ago
When I worked in price crawling there were rumors some proxy vendors leveraged extensions and VPNs (supposedly with fine-print consent) on residential computers to workaround crawl blockers. My guess is that prompted Chrome Webstore to narrow functionality of an extension to only one purpose. These DDoS tools appear to take things to the next level, and an undeniably blackhat direction.
fomine3 3y ago
Isn't it scraping rather than DDoSing?
- sweetjuly 3y ago
  From the captures in the article, it doesn't look like it's sending the data back anywhere. It's mostly just that the endpoint they're hitting is computationally expensive (searches usually are) in an effort to bring the service down without have the raw traffic to actually jam the pipe on bandwidth alone.
intunderflow 3y ago
Unfortunately Google makes it extremely hard to report this sort of Abuse to them, offering no free-form input to tell them what the issue with the application is.
- zo1 3y ago
  The fact that this thing has 5 million installs is disturbing. You generally assume that the large install count apps have been vetted. Or at least that this kind of thing like in the article has surfaced way before millions of installs and the app was taken down.
  - prox 3y ago
    I had a Chinese video app, like 10+ million installs and it bricked my tablet. It worked by only targeting people with other keyboards then Chinese.
- jsnell 3y ago
  This is the form for reporting malware on Play, and it includes a free-form text input for describing the issue: https://developers.google.com/android/play-protect/pha-reporting https://developers.google.com/android/play-protect/pha-repor... (It is a bit odd that there's no DoS category on the report form, despite it being listed as a category on their taxonomy page at https://developers.google.com/android/play-protect/phacategories https://developers.google.com/android/play-protect/phacatego..., but I expect that you can just enter that in the "other" free text field.)
layala6497 3y ago
Not only one website, but multiple websites to abuse and DDoS them
abalashov 3y ago
I hadn't really thought about it before, but it makes sense, upon reflection, that the temptation to appropriate mostly idle consumer computing resources for something is too great to ignore.
AHOHA 3y ago
All free VPNs == malware All paid VPNs == honeypots
- proxiful-wash 3y ago
  Is Freemium VPN a thing? If these are the options it seems like this could be the middleware gap the industry is begging for because both of these options as is suck.
  - kataklasm 3y ago
    Am I understanding correctly that you want a honeypot that serves malware?
- mbrochh 3y ago
  Mullvad and Proton have pretty good reputation, no? You think they are honeypots?
  - AHOHA 3y ago
    You can’t prove otherwise unfortunately, you have to trust the provider.. trusting only. I would personally stay away from proton for anything, vpn or email, I’ve been following their news since started and a lot of sketchy things about them, you can read about some of it here (1), the CEO of protonvpn and Tesonet (data mining company) is the same person, they used to have a lot of vulnerabilities and bad patching system (2)(3). There are other stuff about it can’t find the reference for right now (hmmm?), but I can dig deep later if needed. Mullvad has been better so far, I personally use / used it, last two years been really bad with their network, and recently they stopped port forwarding (4), but again, you have to trust them. (1) https://encryp.ch/blog/disturbing-facts-about-protonmail/ https://encryp.ch/blog/disturbing-facts-about-protonmail/ (2) https://blog.talosintelligence.com/vulnerability-spotlight-multi-provider-vpn-client-privilege-escalation/ https://blog.talosintelligence.com/vulnerability-spotlight-m... (3) https://www.scmagazine.com/news/network-security/protonvpn-and-nordvpn-reinforce-incomplete-patch-for-code-execution-bug https://www.scmagazine.com/news/network-security/protonvpn-a... (4) https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...
simondotau 3y ago
This activity was identified on Android. It doesn't occur on iOS, because on that platform, VPNs are made resident by the operating system exclusively. Providers' apps are just a VPN configuration tool.
- sznio 3y ago
  It has nothing to do with it. This app just makes web requests, and any app can make web requests. The vpn functionality is secondary.
  - msoad 3y ago
    Not in the background. Apple has a very different system for background app refresh. So only when the app is in the foreground or recently closed it can perform an arbitrary http request
  - simondotau 3y ago
    This is technically true in the abstract, but your implied accusation is not consistent with the facts as presented by the article's author in a recent addendum. From the article: "Some people wrote me saying that the DDOS is not happening on ios devices. Just did a quick check and you guys are right. iOS app is using different way to do VPN and also does not do anything suspicious. I should appologize to you and to Appstore team for my lazy extrapolation without actually checking it."
- e44858 3y ago
  Not true, you can implement a custom VPN protocol on iOS: https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension
mormegil 3y ago
A big reason for obligatory codesigning and developer accounts for mobile apps has been that we would know _who_ is doing malicious things, right? So... are there lawsuits already? Will someone go to jail? Or at the very least, has the developer been booted from Google Play? (No, not as of now; I reported the app, but I doubt that is a usable venue for cases like this.)
- H8crilA 3y ago
  This is probably the GRU or the SVR running a deployment of this app from a shell company, together with some ad campaign. Or perhaps Chinese intelligence. Turkmenistan, like many other *stans, are currently being non kinetically fought over by China and Russia, a playground of the game of empires. These countries used to be under the Russian protectorate, but then Putin blundered so badly in Ukraine that it would be a shame not to challenge him. I'm not knowledgeable on the situation in each of the former Soviet *stans, but the general picture is pretty clear. There's another story on HN today, the famous story of CIA setting up shell companies to buy Soviet titanium for the SR-71. The Soviet counterintelligence was completely fooled. This stuff is bread and butter for the more aggressive intelligence departments around the world. I think that shit like this should be reported to law enforcement, so that they can route it to national intelligence or counterintelligence. They can decide to shut it down or investigate further. Opening the case in public let's the other side do a quick cleanup.
joshstrange 3y ago
> new: Some people wrote me saying that the DDOS is not happening on ios devices. Just did a quick check and you guys are right. iOS app is using different way to do VPN and also does not do anything suspicious. I should appologize to you and to Appstore team for my lazy extrapolation without actually checking it. Unfortunately I don’t have much time to fix the article right now, so please just ignore anything ios related below this line. FTA: > I have to give props for Swing VPN teams creativity to bypass security measure of Apple appstore and Google PlayStore but it is sad that Apple/Google security systems does not have some automated ways to detect these types of actions. You couldn't rewrite it to just be: I have to give props for Swing VPN teams creativity to bypass security measures of the Google PlayStore but it is sad that Google security systems does not have some automated ways to detect these types of actions. (Note: A previous version mention the Apple App Store but the iOS version does not appear to participate in these DDOS attacks) The explanation about not fixing the article is longer that the entire paragraph that only needed 22 characters removed (and potentially a sentence added). I don't get it.
leokennis 3y ago
Most markets have several products/services worthy of attention. But in the “consumer VPN” space I think https://mullvad.net/ https://mullvad.net/ is the only non-shady clear principles player there is? Even established names like Proton seem to partially swindle you with buzzwords like servers inside Swiss mountains. None of that with Mullvad: clear about what they do, what they don’t do, and how they do what they do.
archon810 3y ago
The app in question is still on the play store. I just installed and quickly uninstalled it so I could leave it at 1-star review. https://play.google.com/store/apps/details?id=com.switchvpn.app https://play.google.com/store/apps/details?id=com.switchvpn....

723 points by campuscodi 3y ago

VPNs in general tend to be super shady. Many vendors surreptitiously use user nodes as exit nodes and route traffic in suspect ways. VPN software stack is surely a major target for state and non-state actors to monitor and exploit.

internetter 3y ago
Hola VPN, for instance, is famous for using the extensions as "exit nodes"
salad-tycoon 3y ago
So does this mean then that if someone appears to be using my IP to do illegal thing x y z police/lawyers would come at me first? If so, would simply having an account and exe file be enough to argue “my wifi is open, I didn’t download all that XYZ!”
- eddythompson80 3y ago
  By the time the police comes at you because of your home IP, they usually have collected a lot more evidence than that. That's why torrenting from your home without a VPN usually just results in a letter from your ISP saying "we know what you're doing. cut it out". No body has ever been convicted with their home IP as the only evidence.
  - greyface- 3y ago
    https://www.npr.org/sections/alltechconsidered/2016/04/04/472992023/when-a-dark-web-volunteer-gets-raided-by-the-police https://www.npr.org/sections/alltechconsidered/2016/04/04/47... Convicted? No. Raided? Yes.
    - eddythompson80 3y ago
      Of course, you get raided most likely once they have sufficient evidence that they'll be able to collect incriminating evidence. Your IP might be enough to get a warrant, but they'll need a lot more to build a case in court. Hence the raid, confiscation of servers, etc.
- autoexec 3y ago
  https://www.cbsnews.com/news/unprotected-wi-fi-getting-owners-in-trouble/ https://www.cbsnews.com/news/unprotected-wi-fi-getting-owner...
deleted 3y ago
[deleted]
jjbinx007 3y ago
I think one major problem is VPNs are advertised or promoted as if they're synonymous with antivirus software. I partially blame the myriad YouTubers who happily push these to their fans to supposedly protect their privacy and protect their computers from harm.
- gurchik 3y ago
  Until recently, eyeglass manufacturers were marketing blue light filtered lenses (which don't even filter much blue light anyway) as a way to prevent macular degeneration, until regulators shut it down. VPN providers shouldn't be allowed to claim that VPNs protect you from malware or that they do a better job at protecting data in transit than vanilla SSL.
  - kaplun 3y ago
    Hey, I have such glasses, and here in France at least they are still marketed. Do you have any reference pointing out the fact that they do not work? (Are they even worse than regular glasses?)
    - gurchik 3y ago
      > they are still marketed They're still marketed as a way to prevent macular degeneration?
  - KnobbleMcKnees 3y ago
    Any source on the blue light filtering not working? I didn't get the filter on my latest glasses and feel like my eyes fatigue more quickly, but I'm aware that could just be aging or a change in monitors, lighting, etc. which have occurred since my last subscription update.
    - gurchik 3y ago
      The lenses I'm talking about are the ones that are completely or nearly completely clear. Here's a photo of the "Everyday" blue light lenses on Zenni Optical as an example. They are marketed as blocking 16x more blue light than normal lenses. https://static.zennioptical.com/marketing/campaign/blokz/2023/LP/carousel/standard-lg.png https://static.zennioptical.com/marketing/campaign/blokz/202... How could it be blocking any significant amount of light in the visible spectrum and still be clear? I'm sure the "16x" claim is true, but normal lenses block a small amount of light. 16 times nearly zero is still nearly zero. It's just a marketing gimmick. Zenni Optical also sells lenses which are orange. I'm sure that actually does block a significant amount of blue light, but I also know from my experience visiting optician offices that many consumers are buying the first kind. I'm aware of studies which link blue light to eye fatigue and disruption of the circadian rhythm but I'm skeptical that blocking 5% of blue light or whatever could have a perceptible medical effect. With that being said, I don't feel strongly about claims like the 16x thing if its actually true (just a bit misleading). My comment above was mostly about the claims that they prevent macular degeneration which there is no evidence for. And regulators are right to jump in before it gets too bad, otherwise why stop at macular degeneration? Just say your lenses prevent hair loss and skin cancer while you're at it.
jangxx 3y ago
Does this also work if you're using the generic OpenVPN client to connect to the VPN? I've used a bunch of different VPN providers over the years, but they usually just offer an OpenVPN configuration that you can use with the normal client. I'm not aware of this also allowing them to send traffic the other way, but maybe it does?
- lyu07282 3y ago
  afaik no that's impossible without modifications of the customers OpenVPN software itself (they would need firewall/iptable rules for NAT, impossible to set via OpenVPN config). That's exactly why it's a bad sign if a VPN provider doesn't just give you VPN configuration files.

account-5 3y ago

I love this sort of thing. I'd love to get into this sort of research. No idea where to start to either acquire the skills or once acquired target the right systems/apps. I can still dream though. Any pointers on where you'd start would be appreciated though.

gremlinsinc 3y ago
I'd literally start any training by asking chatGPT, probably using phind to ensure it's got more up to date info. I wouldn't trust everything it says, but it can help you maybe find your weaknesses on a topic and formulate a self education plan.
raybb 3y ago
I'd recommend watching liveoverflow on YouTube. He has great videos about reverse engineering programs and is very beginner friendly.
jeroenhd 3y ago
In this case, the whole process was just "let's see what my device is doing" and then digging until the unexplained is explained. Your devices are doing lots of weird things, talking to tracking servers, fetching data from unexpected places, you just need to take a look and start wondering! Running Wireshark or an equivalent smartphone app is easy. Understanding it probably a lot less so, but network protocols can be googled. One trick to not get overwhelmed too much is to not use the device you're analyzing too much so you only collect background traffic. Another is to filter out traffic you can't do much with. A lot of traffic is encrypted by TLS these days, but a lot of data is still visible, like in this case a random domain that you shouldn't be seeing. However, except for that very first TLS packet, you won't be able to see anything interesting in the rest of the stream, which can be gigabytes in size! The real challenge for network analysis is that 99% of the time, your network is not doing anything strange (or at least interesting). If you want to find something, you can try seeking out sketchy apps (free VPNs are a nice target, they're almost always shady) but there's no guarantee that you'll find anything. Or you can dive deeper if you think there's more to be found. In the case of Android apps, those are often easily decompiled into either VM byte code (smali) or even obfuscated Java code. apktool, jd-gui, or ghidra can usually get some kind of readable-ish code out of an app. There's also an excellent online APK decompiler if you trust that. Grabbing the APK is quite easy, you can find apps that do this or otherwise you can use Android's debugging tools to pull the app off your phone. Depending on how obfuscated your target is, complete reversing may be difficult. You can often take shortcuts, though, like looking for interesting strings or setting files. Another nice trick to employ when reversing applications is to run Frida. Frida is a toolkit for injecting arbitrary code into another process. You can either inject Frida into an APK you've downloaded, or if you've got a rooted device run it against any unmodified app. It works on other platforms as well! With Frida you can write Javascript in the Chrome dev tools to control the app, list objects and functions, call random APIs, whatever you need, all without decompiling. Another trick I like to employ is using mitmproxy to man-in-the-middle apps so you see every HTTPS call they make, the responses, and you can even mess with the traffic (change responses, alter requests, you name it). The tricky part is to get the app to accept your TLS interception, but there are Frida scripts that will disable validation of TLS certificates in all manner of apps, giving you the ability to inspect them. That last part can also be very useful if you're reverse engineering an API. I've written a blog post about a Norton VPN where I did exactly that, not because Norton was being shady, but because I wanted to use the OpenVPN config file on my laptop and they didn't provide me with the necessary files (even though they totally could have).

ctippett 3y ago

Excellent sleuthing! I sometimes use Proxyman to sniff the traffic that my phone or computer is using – it's fascinating seeing what and how different apps communicate with their backend servers. I haven't come across anything quite so nefarious, but its interesting all the same.

esafak 3y ago

Don't leave us hanging! Whodunit?

eddythompson80 3y ago
What do you mean? Swing VPN is a "free VPN" service that's actually operating a botnet. Swing VPN dunit.
- CharlesW 3y ago
  Often, the VPN maker is different than the botnet provider. https://scrapestack.com/faq https://scrapestack.com/faq: Residential ("premium") proxies provide IP addresses that are connected to real residential addresses and devices, which makes them much less likely to get blocked while scraping the web. We highly recommend using residential proxies for your web scraping needs as they make it easy to work around geo-blocked content and harvest data at scale.
- esafak 3y ago
  I doubt somebody started or paid a VPN to strike Turkmenistan Airlines for shits and giggles. I suspect there is more to the story.
  - sim7c00 3y ago
    its not clear its ddos, though it might be, as one commenter suggested it might be ad revenue or so. maybe they hit themselves? :D. i bet we will never know.
  - eddythompson80 3y ago
    No body starts a botnet to hit one target. Botnets are usually for hire. You find a vulnerability, establish as many C&C devices as you can, then advertise online that you have a botnet capable of XYZ, and you get contracts to hit particular endpoints. In this example, Swing VPN is offering a "free VPN" service, but they actually pay for it with botnet contracts.

gurchik 3y ago

> After app startup, language selection and acceptance of privacy policy the app starts to figure out ‘real IP address’ by doing a request to both google and bing with query “what+is+my+ip”. My guess is that the app just parses the returned HTML and figures IP from those responses. Aren't there free APIs to get your IP address, like ifconfig.me? This sounds like more work but probably doesn't have any chance of running into rate limits.

starttoaster 3y ago
There are APIs, and in my opinion, just falling back to a different HTTP API would probably be easier than parsing HTML. Though I use one of those APIs for a dynamic DNS client I built, and I've never actually seen a rate limit on them, even if I'm calling them every minute. I appreciate you showing them the benefit of the doubt here, but in my opinion the more likely answer is just that the person who did this is just underinformed on the state of quality of life-improving public APIs.
- nerdponx 3y ago
  It's also borderline trivial to set up your own on a VPS with Nginx.
  - LtdJorge 3y ago
    And leave traces?
judge2020 3y ago
Every cloudflare site responds with `ip=x.x.x.x` at /cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace https://troyhunt.com/cdn-cgi/trace
- ignoramous 3y ago
  I often use cdn-cgi/trace endpoints to do latency measurements, sync time, geo-locate; real handy.

womitt 3y ago

Maybe not ddos just pushing up view counts for money

pie2pie 3y ago
[dead]

sim7c00 3y ago

nice findings, firstly, thanks for looking into it and sharing. i wonder how they have 3 million installbase. do you think there are some (unwitting) influencers, streamers etc. paid to promote this? 3 million is plenty, especially since there are a lot of heavily promoted vpns out there bidding for installs

pfooti 3y ago

So is hola vpn: https://www.theregister.com/2015/06/10/hola_gets_holes_poked_in_client_lulzsec/ https://www.theregister.com/2015/06/10/hola_gets_holes_poked... At this point one must assume that any "free" vpn software is free because it uses its install base for DDoS / other traffic abuse.

moffkalast 3y ago
Yeah, Nord is for example infamous for pimping out their users as scraping proxies: https://oxylabs.io/pricing/residential-proxy-pool https://oxylabs.io/pricing/residential-proxy-pool
- jvanderbot 3y ago
  I don't know why, but I did not expect a completely public, normal looking pricing page for something this nefarious-seeming.
- sim7c00 3y ago
  luminati.io, similar for hola. guess they rebranded now as that one redirects :p but its still the same. this should be illegal really...
- KomoD 3y ago
  Nord as in NordVPN? Source in that case please?
  - moffkalast 3y ago
    https://www.techradar.com/news/judge-orders-mediation-after-jury-orders-oxylabs-to-pay-dollar75m-in-latest-episode-of-proxy-wars https://www.techradar.com/news/judge-orders-mediation-after-... http://web.archive.org/web/20191128170008/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 http://web.archive.org/web/20191128170008/https://medium.com... It's pretty well known.
    - KomoD 3y ago

throwaway8_56 3y ago

> we probably can assume that this app is trying to attack some government sites of Turkmenistan. It is hard for me to imagine why would anybody do that I find this very odd that they would target those websites. What would be the gain of taking down those websites _for anyone_. I doubt that the reason is political. P.S. Turkmenistan is probably the worst country when it comes to free internet. Almost all IP addresses are blocked, with very few websites (mostly google-owned) being reachable. The entire population is desperate for VPN (preferrably free). They are not educated about malwares, or anything about security, so they will download anything that promises free internet.

dclowd9901 3y ago
Couldn’t it just be old fashioned blackmail? Attack the site and request money to turn off the botnet? It might be a bad assumption on my part but it occurs to me that maybe Turkey doesn’t have a lot of pull to investigate cyberattacks across country lines so businesses in that country might be good targets to not get blowback?
- throwaway8_56 3y ago
  Turkmenistan certainly has no capacity for investigating a cyber attack for sure. But they are have no problem with those websites being down. Internet usage in the country is very low, and those websites are down the most of the time anyway.
- LtdJorge 3y ago
  Turkmenistan*
RobotToaster 3y ago
Turkmenistan is part of China's BRI, so it could be any state that wants to see that fail?

homero 3y ago

All free VPNs are malware

zidoo 3y ago

free vpn == click highjacking on affiliate networks. but botnets will work too.

pie2pie 3y ago

[dead]

thrdbndndn 3y ago

I'm not sure if it's appropriate to give unsolicited suggestions on the writing, but I believe the author could improve the conciseness. It reads a bit verbose in places where certain information is repeated multiple times, such as the mention of configurations were retrieved from GitHub and Google Drive sites.

LordShredda 3y ago
Writing technical articles is hard. They're usually research note dumps or technical jargon mixed in with some english words.

ghoshbishakh 3y ago

Installing a client always opens up these risks. That is why I am building a clientless tunneling service ( well technically you bring your own client ) - https://pinggy.io https://pinggy.io which is similar to ngrok but you can connect using your own ssh client such as openssh.

lxgr 3y ago
This article is about a VPN service. How does a clientless ngrok alternative help here (which tunnels server traffic), and why is it even necessary given that many OSes support at least one VPN protocol natively?
- ghoshbishakh 3y ago
  I am saying this attack works only because a client is installed on the device, and that client is malicious. If there was a standard client such as openvpn client (open source) then this attack will not be possible. That is becasue, the vpn provider will not have any means of using the user's device to send arbitrary network packets to any server to launch a ddos.
lionkor 3y ago
Been a happy Mullvad.net customer for a while now, partially because it allows just grabbing a wireguard or openvln config, no client needed

sim7c00 3y ago

for ppl wanting a vpn which does not do this. at the monthly rate things like nord charge, u can rent a server, install openvpn amd be free of this stuff. ofcourse, the server is yours and tracible to you, but still it has all the other benefits which i think normal vpn users crave. (visit plaintext sites over insecure wifi but no eves on the line etc.). its fairly easy to set up and definitely you wont be part of a traffic redirection network, for whatever purposes the redirection is. maybe u can connect ur friends too and be a good samartian :)

lxgr 3y ago
> visit plaintext sites over insecure wifi but no eves on the line etc. Not a rhetorical question: When is the last time you’ve visited a non-HTTPs website? > you wont be part of a traffic redirection network These are also only a concern for HTTP. Other common use cases for VPNs include geo-unblocking, and hosting IP ranges are commonly blocked by streaming sites. I can’t think of a good reason to use a VPS for a VPN anymore these days, to be honest – the privacy/security landscape has changed dramatically over the last few years. You probably get better privacy these days on public (free/unauthenticated) Wi-Fi than you would on many "free" or paid VPN services.
- fragmede 3y ago
  I don't get why people buy cars anymore when there's Lyft and Uber. The transportation landscape has changed dramatically over the last few years.
  - lxgr 3y ago
    Seems like you misread my comment as "there is no need for VPNs anymore these days". I'm merely saying that I don't see the use case for the "self-hosted VPN server" model anymore. Need to bypass geoblocking, e.g. when traveling? You'll likely need a residential IP -> use your own network at home (e.g. Tailscale or a self-setup solution) or one of the shady "residential IP broker" utilizing commercial VPNs out there. Want privacy (from visited sites' trackers)? Your VPS is definitely not that: The IP is static, and if you send your entire traffic through it, this is much more fingerprintable than even residential web usage. -> Use a commercial VPN that you can trust (I don't know many) or something like iCloud Private Relay or TOR. Want privacy from your ISP tracking you (including public Wi-Fis), and only that? Then, yes, a VPS-based VPN might be for you (or any of the commercial VPNs out there). But my claim is that the last one (and only that) is probably not the biggest concern of most people.

jsnell 3y ago

Great writeup! > I have to give props for Swing VPN teams creativity to bypass security measure of Apple appstore and Google PlayStore but it is sad that Apple/Google security systems does not have some automated ways to detect these types of actions. It's a tricky problem. The amount of attack traffic from an infected device is negligible and very little of it is visible to the operating system due to TLS. It's also presumably intermittent (there's no point in keeping an attack ongoing forever; you stop when the site has found a way to defend itself), so just running the app for a while as part of validating an update might not show any suspicious behavior. The suspicious part is in the configurations downloaded from the CnC servers, not packaged with the app, so static analysis won't help. The only reliable option for catching these proactively thatI can think of would be to use some kind of aggregate telemetry from all the app installations combined, but that'd be incredibly scary both in terms of privacy and the blast radius when something goes wrong. > Currently in the beginning of June 2023 it has over 5 million install base on android That's not really a reliable number. It's more like "the number of distinct users who had this app installed at some point". AFAIK it doesn't get decremented when somebody uninstalls the app, and doesn't go up when somebody installs it for a second time on a new device. Those factors might cancel out, might not.

deleted 3y ago
[deleted]

mike_hock 3y ago

> doing a request to both google and bing with query “what+is+my+ip”. My guess is that the app just parses the returned HTML and figures IP from those responses. lol

Waterluvian 3y ago
This is interesting. Does this make it harder to filter/blacklist once discovered? Or is this just incompetence? If I had a known user agent doing a curl to icanhazip or whatnot, could that eventually be blacklisted?
- mike_hock 3y ago
  I don't get it. Where does the VPN traffic go through? If they can operate a gateway, then surely they can provide their own endpoints for IP discovery (and also C&C for that matter). Until it's discovered, traffic to their own servers would appear the most innocuous. After that, the app gets kicked off the store and the server doesn't matter. Unless it doesn't actually do any VPN and it's all just a farce, lol.

OJFord 3y ago

Yeah, this and countless others that nobody's ever heard of except through a YouTube advert making questionable claims with a questionable definition of 'VPN'. (To answer the inevitable: Mullvad and Proton are the legitimate offerings that spring to mind.)

badcarbine 3y ago

Written by AI

deleted 3y ago

[deleted]

dishsoap 3y ago

Hilarious conclusion from the author. It's almost certainly not the case that the owners of this service are using it to 'DDoS' targets, rather it's much more likely they are using your device to host a proxy server and then selling access to some 'residential proxy reseller'. On the other side of that, some random Joe has probably purchased access to a set of these 'residential proxies' and is using them to scrape flight data from the airline site the article author noticed, with some of those requests being sent over the author's connection. Many 'free vpn' and 'free proxy' apps engage in this behavior, you may proxy your requests via their connection, but they also proxy their requests via yours, generally reselling that access to someone who finds your IP address to be of value to them due to the fact that it's not a datacenter address. It's certainly questionable to straight up unethical either way, especially so if the service doesn't disclose to you that they're doing that, but on the other hand I find the author's DDoS conclusion to be so contrived and out of touch with reality that I had to write this comment.

bibabaloo 3y ago
Pretty harsh to say that this is a hilarious conclusion when your own conclusion seems even more rash. If your conclusion was the case, wouldn't that mean there'd also have to be people interested in scraping random (static) https://www.science.gov.tm/ https://www.science.gov.tm/ pages?
aaronharnly 3y ago
Did you read the part where there was a hosted, downloaded, config file that contained the target URLs? That doesn’t seem proxylike. "urlList": [ { "url": "https://turkmenistanairlines.tm/tm/flights/search?_token=J8SxUX2Qwzltw4LiHsRHTCtfthgBYxf4hyI8oNly&search_type=internal&departPort=TAZ&arrivalPort=CRZ&tripType=rt&departDate=4%2F22%2F2023&arrivalDate=5%2F4%2F2023&adult=1&child=0&infant=0&is_cship=on", "method": "GET" },
- dandongus 3y ago
  My mistake, I looked at the article for 10 seconds before assuming that this app is no different than hundreds of other ones, apparently it is a rare outlier. At any rate, there are more effective ways to disrupt service if that was the goal.

klysm 3y ago

No free lunch

jongjong 3y ago

DoS should be legalized IMO... If a company cannot mitigate a DoS or DDoS attack and stay profitable, it's their own fault. Their fault for not designing their software properly and their fault for accumulating too many enemies. Probably it would bring down the whole DNS system but it's about time we replaced it with something better and more decentralized anyway. DDoS is just freedom of speech. Just some people have louder voices than others which is not a foreign concept to the rest of us. So long as the VPN (or whatever) operator mentions it in their terms of service (e.g. if they rely on user resources), it's fine IMO. There needs to be an incentive for companies to implement good quality software and to not be evil (not to make enemies) and legalizing DDoS might help create such an incentive.

hn_acker 3y ago
> DoS should be legalized IMO... If a company cannot mitigate a DoS or DDoS attack and stay profitable, it's their own fault. Their fault for not designing their software properly and their fault for accumulating too many enemies. Getting DoS-ed is sufficient "punishment" for not being able to mitigate a DoS. "their fault for accumulating too many enemies" is dubious considering that one "enemy" is enough for a DoS and that the DoS-er might not actually have something personal against the target. > DDoS is just freedom of speech. Just some people have louder voices than others which is not a foreign concept to the rest of us. I wouldn't characterize a DoS-er as "the one with the louder voice". I hope you don't think doxxing and revenge porn should be legal too. Anyway, there's the saying "My right to swing my fist ends where your nose begins."
- jongjong 3y ago
  I see it differently and I have gained a different understanding of "My right to swing my fist ends where your nose begins." I used to think like that but in reality, the way the world really works is that anyone can punch you in the nose if they really want to... Whether or not the assailant will be punished for that depends on who got punched and who did the punching. Access to the justice system is asymmetrical. Big corporations or organizations are often not held liable for many of their 'crimes' on a per-infraction basis because their victims have a much weaker voice; they can basically do all the crimes they want and then, if they harm enough people and they get caught and there is a class action (a lot of IFs), they MAY pay a lump sum fine at the end. I prefer the ancient Roman system where some crimes were forgiven based on context (e.g. retaliation was allowed). I think it would bring back the human element to the justice system. People should be allowed to take the law into their own hands provided that their cause can be morally justified in front of a random sample of citizens.

paulryanrogers 3y ago

When I worked in price crawling there were rumors some proxy vendors leveraged extensions and VPNs (supposedly with fine-print consent) on residential computers to workaround crawl blockers. My guess is that prompted Chrome Webstore to narrow functionality of an extension to only one purpose. These DDoS tools appear to take things to the next level, and an undeniably blackhat direction.

fomine3 3y ago

Isn't it scraping rather than DDoSing?

sweetjuly 3y ago
From the captures in the article, it doesn't look like it's sending the data back anywhere. It's mostly just that the endpoint they're hitting is computationally expensive (searches usually are) in an effort to bring the service down without have the raw traffic to actually jam the pipe on bandwidth alone.

intunderflow 3y ago

Unfortunately Google makes it extremely hard to report this sort of Abuse to them, offering no free-form input to tell them what the issue with the application is.

zo1 3y ago
The fact that this thing has 5 million installs is disturbing. You generally assume that the large install count apps have been vetted. Or at least that this kind of thing like in the article has surfaced way before millions of installs and the app was taken down.
- prox 3y ago
  I had a Chinese video app, like 10+ million installs and it bricked my tablet. It worked by only targeting people with other keyboards then Chinese.
jsnell 3y ago
This is the form for reporting malware on Play, and it includes a free-form text input for describing the issue: https://developers.google.com/android/play-protect/pha-reporting https://developers.google.com/android/play-protect/pha-repor... (It is a bit odd that there's no DoS category on the report form, despite it being listed as a category on their taxonomy page at https://developers.google.com/android/play-protect/phacategories https://developers.google.com/android/play-protect/phacatego..., but I expect that you can just enter that in the "other" free text field.)

layala6497 3y ago

Not only one website, but multiple websites to abuse and DDoS them

abalashov 3y ago

I hadn't really thought about it before, but it makes sense, upon reflection, that the temptation to appropriate mostly idle consumer computing resources for something is too great to ignore.

AHOHA 3y ago

All free VPNs == malware All paid VPNs == honeypots

proxiful-wash 3y ago
Is Freemium VPN a thing? If these are the options it seems like this could be the middleware gap the industry is begging for because both of these options as is suck.
- kataklasm 3y ago
  Am I understanding correctly that you want a honeypot that serves malware?
mbrochh 3y ago
Mullvad and Proton have pretty good reputation, no? You think they are honeypots?
- AHOHA 3y ago
  You can’t prove otherwise unfortunately, you have to trust the provider.. trusting only. I would personally stay away from proton for anything, vpn or email, I’ve been following their news since started and a lot of sketchy things about them, you can read about some of it here (1), the CEO of protonvpn and Tesonet (data mining company) is the same person, they used to have a lot of vulnerabilities and bad patching system (2)(3). There are other stuff about it can’t find the reference for right now (hmmm?), but I can dig deep later if needed. Mullvad has been better so far, I personally use / used it, last two years been really bad with their network, and recently they stopped port forwarding (4), but again, you have to trust them. (1) https://encryp.ch/blog/disturbing-facts-about-protonmail/ https://encryp.ch/blog/disturbing-facts-about-protonmail/ (2) https://blog.talosintelligence.com/vulnerability-spotlight-multi-provider-vpn-client-privilege-escalation/ https://blog.talosintelligence.com/vulnerability-spotlight-m... (3) https://www.scmagazine.com/news/network-security/protonvpn-and-nordvpn-reinforce-incomplete-patch-for-code-execution-bug https://www.scmagazine.com/news/network-security/protonvpn-a... (4) https://mullvad.net/en/blog/2023/5/29/removing-the-support-for-forwarded-ports/ https://mullvad.net/en/blog/2023/5/29/removing-the-support-f...

simondotau 3y ago

This activity was identified on Android. It doesn't occur on iOS, because on that platform, VPNs are made resident by the operating system exclusively. Providers' apps are just a VPN configuration tool.

sznio 3y ago
It has nothing to do with it. This app just makes web requests, and any app can make web requests. The vpn functionality is secondary.
- msoad 3y ago
  Not in the background. Apple has a very different system for background app refresh. So only when the app is in the foreground or recently closed it can perform an arbitrary http request
- simondotau 3y ago
  This is technically true in the abstract, but your implied accusation is not consistent with the facts as presented by the article's author in a recent addendum. From the article: "Some people wrote me saying that the DDOS is not happening on ios devices. Just did a quick check and you guys are right. iOS app is using different way to do VPN and also does not do anything suspicious. I should appologize to you and to Appstore team for my lazy extrapolation without actually checking it."
e44858 3y ago
Not true, you can implement a custom VPN protocol on iOS: https://developer.apple.com/documentation/networkextension https://developer.apple.com/documentation/networkextension

mormegil 3y ago

A big reason for obligatory codesigning and developer accounts for mobile apps has been that we would know _who_ is doing malicious things, right? So... are there lawsuits already? Will someone go to jail? Or at the very least, has the developer been booted from Google Play? (No, not as of now; I reported the app, but I doubt that is a usable venue for cases like this.)

H8crilA 3y ago
This is probably the GRU or the SVR running a deployment of this app from a shell company, together with some ad campaign. Or perhaps Chinese intelligence. Turkmenistan, like many other *stans, are currently being non kinetically fought over by China and Russia, a playground of the game of empires. These countries used to be under the Russian protectorate, but then Putin blundered so badly in Ukraine that it would be a shame not to challenge him. I'm not knowledgeable on the situation in each of the former Soviet *stans, but the general picture is pretty clear. There's another story on HN today, the famous story of CIA setting up shell companies to buy Soviet titanium for the SR-71. The Soviet counterintelligence was completely fooled. This stuff is bread and butter for the more aggressive intelligence departments around the world. I think that shit like this should be reported to law enforcement, so that they can route it to national intelligence or counterintelligence. They can decide to shut it down or investigate further. Opening the case in public let's the other side do a quick cleanup.

joshstrange 3y ago

> new: Some people wrote me saying that the DDOS is not happening on ios devices. Just did a quick check and you guys are right. iOS app is using different way to do VPN and also does not do anything suspicious. I should appologize to you and to Appstore team for my lazy extrapolation without actually checking it. Unfortunately I don’t have much time to fix the article right now, so please just ignore anything ios related below this line. FTA: > I have to give props for Swing VPN teams creativity to bypass security measure of Apple appstore and Google PlayStore but it is sad that Apple/Google security systems does not have some automated ways to detect these types of actions. You couldn't rewrite it to just be: I have to give props for Swing VPN teams creativity to bypass security measures of the Google PlayStore but it is sad that Google security systems does not have some automated ways to detect these types of actions. (Note: A previous version mention the Apple App Store but the iOS version does not appear to participate in these DDOS attacks) The explanation about not fixing the article is longer that the entire paragraph that only needed 22 characters removed (and potentially a sentence added). I don't get it.

leokennis 3y ago

Most markets have several products/services worthy of attention. But in the “consumer VPN” space I think https://mullvad.net/ https://mullvad.net/ is the only non-shady clear principles player there is? Even established names like Proton seem to partially swindle you with buzzwords like servers inside Swiss mountains. None of that with Mullvad: clear about what they do, what they don’t do, and how they do what they do.

archon810 3y ago

The app in question is still on the play store. I just installed and quickly uninstalled it so I could leave it at 1-star review. https://play.google.com/store/apps/details?id=com.switchvpn.app https://play.google.com/store/apps/details?id=com.switchvpn....