9 ms·
Hola VPN Already Exploited by “Bad Guys”, Security Firm Says
- jalopy 11y agoAnyone have insights into the latest and greatest tools to search for and remove possible malware installed by Hola?
- jmkni 11y agoHola really don't make it clear what you are installing when you download it. All you think is, "I'm installing a browser add-on to watch Netflix in another country". You sort of assume it's only actually running when you are actively using it for Netflix, but it's running all of the time. I first noticed something was up when I installed Hola (for Netflix) then all of a sudden Fiddler wouldn't work anymore. Had me completely stumped, then somebody on StackOverflow suggested turning off Hola and that indeed sorted it. - http://stackoverflow.com/a/19905099/969613 http://stackoverflow.com/a/19905099/969613
- BoppreH 11y agoSelling user's bandwidth is shady, but consistent with VPN usage (i.e. traffic routing). You can present it as "hey, that's our actual business model, we just forgot to tell you guys" and maybe get away with it. But this: Hola [...] installs its own code-signing certificate on the user’s system. Hola contains a built-in console (“zconsole”) that is not only constantly active but also has powerful functions including the ability to kill running processes, download a file and run it whilst bypassing anti-virus software plus read and write content to any IP address or device. This is going so far into shady territory it becomes indistinguishable from actual malware. This is Lenovo/Superfish all over again.
- ChrisArgyle 11y agoI suppose the lesson here is don't use "free" services until you fully understand the provider's business model.
- psykovsky 11y agoSo, basically any VC backed, SV based startup?
- ChrisArgyle 11y agoWell I understand their business model. Given valuation is a function of MAU: 1) Boost MAU by any means necessary 2) Pray 3) Monetize/get acquired
- psykovsky 11y agoThat's the business model of VC's and Founders, not the companies. The company business model will only be established on 3, if they monetize. Selling to the bigger fool not included, ofcourse.
- cmdrfred 11y agoMaybe the lesson is when the sign says "Free Pork"(Bandwidth) ask where it came from?
- madeofpalk 11y ago> This is Lenovo/Superfish all over again. Completely different. Superfish, I'm willing to believe, was just incompetence/indifference. If Hola really is installing a backdoor with high privileges, then that's deliberate malice.
- chimeracoder 11y ago> Superfish, I'm willing to believe, was just incompetence/indifference. If Hola really is installing a backdoor with high privileges, then that's deliberate malice. But that's what Superfish was as well. Why are you willing to give Superfish a free pass on doing the same thing?
- rev_bird 11y agoNot sure, but I think I might be on madeofpalk's team on this one too: Superfish was ostensibly doing it to feed data into targeted advertising; Hola has no such (marginally) benevolent excuse.
- chimeracoder 11y agoFirst, I fundamentally disagree that targeted advertising is in any way benevolent, even marginally. Though that's a debate for another thread. However, they knew full well what they consequences of this mechanism would be[0]. I find it impossible to believe that there was no person at any point along the chain who knew that MITMing all connections would be a security vulnerability[1]. And if that somehow managed to be the case, that makes them even less credible in my mind, since they're an OEM. They really have no excuse. [0] I mean, seriously, just look at the name "Superfish". That's not a catchy phrase invented to publicize the vulnerability, like "Heartbleed" and "Shellshock". That's the actual name of the company whose product Lenovo bought. [1] https://news.ycombinator.com/item?id=9078536 https://news.ycombinator.com/item?id=9078536
- onli 11y agoThere is quite a difference between the security issues of MITM HTTPS and installing a control console. The first is a potential security issue that might lead to something bad, the seconds is already one of those bad things that might happen. Given that this console is as exploitable as it sounds.
- Kronopath 11y agoAlright, let's talk specifics. 1. Is the Hola Chrome extension vulnerable to these kinds of issues? 2. How can you remove/fix these issues? Is uninstalling Hola enough?
- ThePhysicist 11y agoHola is going down a dangerous route here by turning all of their users into exit nodes, but if they actually make this work it would give them a unique position among all VPN providers. Legally this is a very risky endeavor though. In Germany for example (where I'm based), people are even scared of sharing their Internet contract with their neighbors since the account owner can be held responsible for any illegal activities (e.g. downloading copyrighted content) that are carried out through his/her connection. Allowing other people to "freeload" on my connection would therefore be a big no-no here. The only way around this risk would be to record and attribute the connection information to each user of the service, but this would of course eliminate many of the advantages of using a VPN again (e.g. privacy).
- revelation 11y agoDownloading copyrighted content is the least of worries here, that is mostly a private matter. But there is a very real risk that if someone accesses child pornography and other content using Hola and your internet connection that you will wake up to police searching your home.
- anonycount 11y agoThis is a far more real risk than you might think, I'm currently on the tail end of a police investigation triggered by a device on my home network accessing child porn via Tor. My current theory is that something got added to a botnet and used as a proxy, but I'm not eager to leave things running to find out. While the police have been incredibly professional about this, its been a truly horrible process. Anything in my house which could be used for digital storage was seized, and I spent 9 hours in a police station, variously being interviewed, and sitting in a cell with plenty of time to think about how horribly wrong it could all go. Since then I've been on bail with the condition that I'm not allowed to be unsupervised with anyone under the age of sixteen, which when you have a one year old son is inconvenient to say the least - there was a short time when it seemed a real possibility that he may be taken into care because social services didn't like that my wife believes I'm innocent. It also cost us hundreds of pounds in buying new laptops to use for work while we wait for our existing ones to be returned. Thankfully the investigation is coming to an end now (in fact I got a call this morning to say the remaining two computers are going to be returned tomorrow), and it looks like everything is going to be ok. I've spent the last few months worrying that maybe one of our computers has also been used as a server. To come vaguely back on topic, find a better way to get at TV you want to watch, because no amount of Game of Thrones is worth months of worrying whether the next knock at the door is going to be the police come to take you off to jail.
- expertentipp 11y agoI wish to just use OpenVPN but it's not so easy. Certificates - no problem. Forward DNS requests - there is an option for it in the config file. Routing entire traffic through OpenVPN - quite tricky unless you're fluent in command line network management tools and computer networks in general.
- jaysh 11y agoTry OpenVPNs Access Server - it comes with 2 free licenses and a web UI to configure it. Makes the entire process quite straightforward: https://openvpn.net/index.php/access-server/pricing.html https://openvpn.net/index.php/access-server/pricing.html
- deleted 11y ago[deleted]
- Trellmor 11y agoThere is also an option to route all traffic through the OpenVPN server, and the OpenVPN HOWTO has an entry for it: https://openvpn.net/index.php/open-source/documentation/howto.html#redirect https://openvpn.net/index.php/open-source/documentation/howt... Instead of using the push setting in the server config you can also set redirect-gateway in the client config.
- yardie 11y agoThis is quite odd, most VPN routers make full tunneling very easy. Literally a checkbox in the control panel. It's when you want to do split tunneling that you have added the complexity of writing rules and sanity checking.
- exo762 11y agoI often use this tool. https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle No need to configure anything at remote host, no excessive amount of options. Capable of DNS forwarding, routing of entire traffic or just traffic to chosen remote hosts.
- Labyrinth 11y agoComing from the receiving end of this. As a user of a anonymous image board this happen recently. It seems that hola is selling botnet access. Of course users are "vetted" that they are not going to use the access for nefarious purposes before they gain access. In this case one of the "vetted" users decided to DDOS said anonymous image board. (Note:Could be some other actors involved, but have confirmation from other board users). Update(Confirmation from TorrentFreak): http://torrentfreak.com/hola-vpn-sells-users-bandwidth-150528/ http://torrentfreak.com/hola-vpn-sells-users-bandwidth-15052...
- j_s 11y agoThis was discussed here last week, with contributions from the owner of the image forum: https://news.ycombinator.com/item?id=9614993 https://news.ycombinator.com/item?id=9614993
- xaitv 11y agoIs there a way to make sure hola uninstalling the hola extension removed everything hola related from my pc? I can imagine with the level of access this extension had(I didn't even know Chrome extensions could have this level of access) just removing the extension isn't enough.
- joshstrange 11y agoI have zero connection to this company but if you are looking for a reliable, fast, unlimited VPN I would check out Private Internet Access (https://www.privateinternetaccess.com/ https://www.privateinternetaccess.com/) I've got a number of friends who use this and I've been using it for a little over a month and have nothing but good things to say. At $40/yr it's well worth it IMHO and provides a native VPN client, PPTP, and Socks5 (They have mobile apps as well to make it easier but you can use PPTP directly as well). I use it 100% of the time on my phone and on my laptop unless I'm at work (internal resources that I haven't figured out how to play nice with yet).
- soylentcola 11y agoI recently bought a year for around $35 with some coupon code or other and honestly...I'm a bit underwhelmed. No matter what settings I use or what node I connect to, my ~100mbps (down) cable connection drops to somewhere between 1-10mbps. I was originally going to set up OpenVPN on my router so everything would go through it but I heard it can tax router hardware and lead to slower speeds so I figured I'd just test the desktop client first. Now I'm glad I didn't go mucking around with my router setup since it would have led to house-wide issues. As it stands, I can handle the slower speeds when torrenting some TV episode I missed but after that, I usually need to turn it off.
- tomjen3 11y agoI am a very happy user, in fact I am writing this behind their vpn. In my experience you are right for some endpoints, some of the time, but I haven't had any issue with the one I am currently using (NL based).
- celticninja 11y agotry out cryptostorm.is i have ad zero issues with them and have been running it for the last few months (>3 <6)
- rev_bird 11y agoThat's the same issue I ran into with using a VPN; I know I want to be using one as a (theoretical) enhancement to my privacy, but it was just too slow.
- bronlund 11y agoIsraeli software with a backdoor! There's a surprise for you %]
- logn 11y agoHola extension has been removed from Firefox and Chrome download sites. I read the source of the Firefox extension at one point and don't remember seeing any binaries or the so-called "zconsole". But CSO Online [1] is reporting the extensions were vulnerable (despite Vectra [2] not mentioning this). It was also unclear to me how the browser extension could be used to share user's traffic; it didn't seem like the extension did that, but I didn't read the source code too carefully. Does anyone has a copy of these extensions? I am disappointed the Windows and Android apps were vulnerable and that Hola didn't market their software better. It's probably the coolest app since Napster. Yes, it's a botnet of sorts, but the Internet needs a way to let users disassociate themselves from IP addresses. And most proxy services are easily identified. [1] http://www.csoonline.com/article/2928817/vulnerabilities/hola-vpn-client-vulnerabilities-put-millions-of-users-at-risk.html http://www.csoonline.com/article/2928817/vulnerabilities/hol... [2] http://blog.vectranetworks.com/blog/technical-analysis-of-hola http://blog.vectranetworks.com/blog/technical-analysis-of-ho...
- timboslice 11y agoThe Chrome store still is hosting Hola: https://chrome.google.com/webstore/detail/hola-better-internet/mhcmfkkjmkcfgelgdpndepmimbmkbpfp https://chrome.google.com/webstore/detail/hola-better-intern...
- toni 11y agoI wonder what caused the surge of all those 5-stars positive reviews within the last 24 hours....
- psykovsky 11y agoHola's marketing team at work.
- Someone1234 11y agoTons of articles being written about it? I hate to say this, but because of Google+ it is pretty easy to see if users are legitimate or not. And from what I could tell many in those reviews are legitimate users (at least on G+).
- zimbatm 11y agoI think that Chrome users are relatively unaffected by this if they installed the extension trough Google Play thanks to Chrome's security model. In that case I think it's just routing the traffic trough their proxy and not installing the shady zconsole or changing the SSL certificates. Still, creating a new user profile just for watching netflix is recommended.
- mladenkovacevic 11y agoAnyone know of a safe VPN app to use on Android? I've been using Cyberghost.
- h4waii 11y agoYour best option? Pick a provider that uses OpenVPN (or roll your own) and use the open source OpenVPN for Android application => https://github.com/schwabe/ics-openvpn https://github.com/schwabe/ics-openvpn. Done.
- bargl 11y agoSo this is interesting to me because lately, I've been looking for a VPN that would work for my little brother who is trying to make it to the point that he can stream full time on Twitch. The problem is that he has been targeted by script kiddies, who found his IP address through Skype. Shame on you skype. That said, I've been looking for a good VPN for him. It seems that ProXpn isn't as solid as I thought it was because they found his IP there and were able to (D)DOS not sure how exactly they are doing it at this point, him. They have also been able to get him banned from Twitch via his IP. He needs a VPN with enough bandwith that he can do Twitch and Skype (under a different name), all while playing games. I figured ProXpn would be sufficient, but I've never loaded it like that. Also, there is no guide out there for streamers, or people who are in the public eye on the internet, on how to avoid getting attacked by script kiddies. Or at least no guide that I've found sufficiently useful, and yes I have googled this. Does anyone here have any references they can point me to that give the "what not to do" for streamers, youtubers, big twitter people, etc? So far I've told him. -Use strong passwords: LastPass and yes I know this is a point of contention but it's better then what he is using and it's accessible enough for him that he'll actually use it. -Don't click links in chat: Because duh (Is there a way to verify the safety of said links first)? I know of none. -Obfuscate your Skype id: This seems to be a major tool in finding IPs. -Keep a personal and a public email: Personal goes to banks and stuff, public goes to everyone else. -Don't friend people on Steam you don't know. Am I missing any major advice points that seem easy to follow? Edit: formatting and added steam bullet point.
- celticninja 11y agotry cryptostorm.is as a VPN
- sarciszewski 11y agoYeah, cryptostorm does a lot to defend users against attacks. Just don't confuse it as a replacement for Tor and you're good to go.
- celticninja 11y ago
- virmundi 11y agoThis seems to be a good place to ask: can Hola do this via their plugins? I tried searching, but couldn't find anything.
- mediascreen 11y agoThey've posted some kind of explanation/apology on their blog: http://hola.org/blog/the-recent-events-on-the-hola-network http://hola.org/blog/the-recent-events-on-the-hola-network
- mackenzielaffer 11y agoi used Hola VPN experience . i am sorry to say used bad experience for web surfing and ip changing because show the top domain surfing our country and reconnect and reconnect the hola ip. Otherwise good system and add on but reconnect the web surfing heritage. it compare the other VPN Like Ivacy and PureVpn is Good Vpn services both experience nice, not encryption from website browsing and surfing , also secure