VPN User Is Not Always Protected Open Wi-Fi Network

People who open Wi-Fi networks by using a VPN to shield their traffic running in theory still risk of data leaks. The problem arises from the action of some open Wi-Fi networks. The VPN can only become connect after the user connects.

With many open Wi-Fi networks, the user must first log on to a portal home page or to accept the conditions before connecting to the Internet. In the time before the VPN is active, there is a theoretical risk that data can not be sent through the VPN and may be in the hands of an attacker. In this case, the user programs, such as an email client, have already started and is being tried for example to send credentials.

In addition, the program must use encryption for the setting up of the connection and sending the login data. If these conditions are met, there is a risk, warns Ars Technica . Users who want to protect themselves against this risk getting Shaun Murphy Private Giant advised to use a software firewall. The firewall to prevent incoming and outgoing connections on public networks, the browser after.

With this particular browser can be logged into the Wi-Fi portal. The browser would then also have to be used only for this purpose. Using the same firewall should then profile / zone for VPN traffic preparations of inbound and outbound traffic is less restricted. In this way, the primary e-mail client and browser will not work until there really is a connection to the VPN. Sean Sullvian F-Secure notes that the browser used in "safe mode" should be started for the wifi portal so no plug-ins are loaded.

Chinese Tor - And VPN Users Exposed Via JavaScript

A select group of Chinese users of VPN services and the Tor network has become the target of a JavaScript attack that attempted to discover their true identities. Reported security Alien Vault Labs .The company took a "watering hole" attack where, with several Chinese-language websites of NGOs, Uighur and Muslim organizations were hacked.

Watering holes are so called because potential victims to visit the websites of itself. In most of these attacks, the attackers put malicious code on the hacked website that visitors often try to infect via an exploit with malware. Researchers at the Chinese-language websites hacked observed a new technique not previously been applied to watering holes.

The websites had placed a malicious JavaScript file which users through " JSONP hijacking "vulnerabilities in more than 15 major Chinese-language websites are attacking. Through JSONP requests the attackers could steal private data from users if they were logged on a vulnerable websites. It involves major Chinese portals like Baidu, Sina and QQ. Then, the JavaScript code sends the information to a server of the attackers.

It may then go to the real user's name and his email address. According Alien Vault Labs was a small group of people the campaign of the target, which aims to unmask users who visit these sites, even if they come through Tor or a VPN. Researchers call the Chinese websites in question to remedy the JSONP vulnerabilities. In addition, users advised to avoid visiting sensitive sites after they have logged on to another website.