'Zero logs' vpn exposes millions of logs including username and passwords in plain texts

[pprnl]

Summary

Hong Kong based UFO VPN exposed millions of log files about users of its service, including their account passwords and IP addresses, despite claiming that it keeps no logs.

 

My thoughts

Mandatory by government perhaps? or just a chineese government business?

 

Sources

https://www.comparitech.com/blog/vpn-privacy/ufo-vpn-data-exposure/

[RejZoR]

UFO VPN. Sounds totally legit and reputable.

[pprnl]

Just now, RejZoR said:

UFO VPN. Sounds totally legit and reputable.

they claim to have 20 million users.

[Statik]

With a name like that, and "Hong Kong Based" I'm not surprised in the least.

[Boomwebsearch]

4 minutes ago, tprnl said:

Summary

Hong Kong based UFO VPN exposed millions of log files about users of its service, including their account passwords and IP addresses, despite claiming that it keeps no logs.

 

My thoughts

Mandatory by government perhaps? or just a chineese government business?

 

Sources

https://www.comparitech.com/blog/vpn-privacy/ufo-vpn-data-exposure/

 

I would recommend to anyone affected or think that they may be affected to change your passwords as soon as possible and ask your ISP about getting a new IP address to prevent anyone that may have got your password from accessing your account/s and causing damage.

 

This emphasizes the importance of only using reputable VPNs and not sending/receiving important information over unsecured networks.

[Windows7ge]

Glad I host my own VPN then. Only logs are my own.

[AlwaysWong]

2 minutes ago, Windows7ge said:

Glad I host my own VPN then. Only logs are my own.

 

How do you host your own vpn?

[SansVarnic]

-= Moved to General Discussion =-

Topic Does not meet the Posting Guidelines for Tech news.

 

 

[pprnl]

13 minutes ago, SansVarnic said:

-= Moved to General Discussion =-

Topic Does not meet the Posting Guidelines for Tech news.

 

 

Can you explain why "Twitter hack" is tech news and "VPN Breach" isn't? Just want to learn.

[WereCatf]

31 minutes ago, tprnl said:

Hong Kong based UFO VPN exposed millions of log files about users of its service, including their account passwords and IP addresses, despite claiming that it keeps no logs.

Usernames and passwords are needed for the service to operate, so those don't count.

[pprnl]

2 minutes ago, WereCatf said:

Usernames and passwords are needed for the service to operate, so those don't count.

passwords in plain text on an unsecured Elasticsearch server, for a vpn provider that claims "bank grade protection"

i just hope they go out of business soon.

[BuckGup]

40 minutes ago, Windows7ge said:

Glad I host my own VPN then. Only logs are my own.

 

That's probably not true. If you host it locally then yes but there isn't really a point to use a VPN then unless you just want encryption. If it's hosted on a VPS then they for sure have logs even if you aren't keeping any

[SpaceGhostC2C]

42 minutes ago, tprnl said:

Can you explain why "Twitter hack" is tech news and "VPN Breach" isn't? Just want to learn.

It doesn't say "the subject is not tech news", it says "post doesn't follow the guidelines". Read the guidelines, adjust your first post, and then the thread can return to Tech News subforum.

[WkdPaul]

1 hour ago, tprnl said:

Can you explain why "Twitter hack" is tech news and "VPN Breach" isn't? Just want to learn.

Please read the posting guidelines that @SansVarnic linked to.

[Windows7ge]

1 hour ago, BuckGup said:

That's probably not true. If you host it locally then yes but there isn't really a point to use a VPN then unless you just want encryption. If it's hosted on a VPS then they for sure have logs even if you aren't keeping any

I own the location the VPN is being hosted at.  But you are correct a VPS service would have logs of their own and it'd defeat the purpose.

[dilpickle]

The important thing people need to understand is that when you use a VPN all you are doing is shifting your trust from your ISP to your VPN provider. If your VPN is not trustworthy then you are no better off. I've never bothered with them as I don't really see the point of them outside of hiding illegal activity. And even then we've seen many "no log" VPNs still providing information to law enforcement.

 

And if you are using ANY service based in China you get what you deserve.

[pythonmegapixel]

15 hours ago, dilpickle said:

The important thing people need to understand is that when you use a VPN all you are doing is shifting your trust from your ISP to your VPN provider. If your VPN is not trustworthy then you are no better off. I've never bothered with them as I don't really see the point of them outside of hiding illegal activity. And even then we've seen many "no log" VPNs still providing information to law enforcement.

Indeed.

 

All of this reinforces my decision to avoid VPN services.

 

I fail to understand what data I have that I wouldn't trust my ISP with but would trust some other random VPN operator with.

Sure, VPNs do have their applications. But they also have some pretty significant risks, and they don't come cheap. Not to mention the fact that many of them apply data caps (seriously, this is 2020, not 2005, ISPs don't limit data anymore) and slow down the connection.

[Kisai]

18 hours ago, BuckGup said:

That's probably not true. If you host it locally then yes but there isn't really a point to use a VPN then unless you just want encryption. If it's hosted on a VPS then they for sure have logs even if you aren't keeping any

There really is no such thing as a "log-less" VPN unless it was designed to run entirely on public key credentials (in a sense, a SSH socks tunnel) and the machine has explicitly had all logging sent to /dev/null , hard to pull off but do-able.

 

However that doesn't mean your VPN adds any value. If the point of the VPN is privacy (as opposed to "doing soft crimes anonymously" which is what most VPN's are really used for, eg piracy, porn and government censorship dodging) then the actual machine has to be setup outside the legal jurisdiction you exist in, and only setup via a proxy (eg someone in that country) who is actually paying for it. That's highly doubtful. The average VPN pretty much is used to dodge geoblocking and ISP tampering, which there really is no law preventing it, so it slides under the radar. If you're paying for it with a credit card, you're aren't anonymous, and if you used a burner email address, that isn't anonymous either. There literately has to be no communication between the one who sets it up and the one who uses it.

 

The reason all these VPN services exist at all was to help people pirate movies/get around geoblocking, and any secondary reason is touted as privacy, even if those privacy features are really intended to block government censorship. Like at least one VPN ISP out there literately exists to enable people in one middle-eastern country watch porn and youtube, which is banned.

 

Like, if you really want to have a VPN, go right ahead, but non-enterprise VPN's really don't protect you from anything if it's convenient to use and pay for.

[Statik]

4 hours ago, pythonmegapixel said:

Indeed.

 

All of this reinforces my decision to avoid VPN services.

 

I fail to understand what data I have that I wouldn't trust my ISP with but would trust some other random VPN operator with.

Sure, VPNs do have their applications. But they also have some pretty significant risks, and they don't come cheap. Not to mention the fact that many of them apply data caps (seriously, this is 2020, not 2005, ISPs don't limit data anymore) and slow down the connection.

It confuses me when there's data breaches for Chinese based, or random no name, or "free" VPNs, and people are blown away and act like all VPNs are cancer and just as or worse off than no VPN.

 

Illegal activity aside, there's plenty of uses for VPNs (privacy, security, geolocked content, avoid throttling, etc). You can also get some pretty solid deals from reputable companies, and they're end up costing as much as a couple coffee's a month. Define "many" on the data cap comment? Pretty much any reputable, popular VPN has zero cap.

 

I think if anyone does their research, and shops around a bit you can find a reliable, safe, no log VPN.

[pythonmegapixel]

8 minutes ago, Statik said:

Illegal activity aside, there's plenty of uses for VPNs (privacy, security)

Tell me what data I should have that I should trust to some random company who sells VPN services, but not to my ISP?

 

 

Quote

geolocked content, avoid throttling, etc

Simply blacklisting VPNs is easily possible (my school has done it for years: Netflix sometimes does it; many minecraft servers do it) and if too many people switch to VPNs then ISPs will start doing it as well.

 

If I'm going to pay for a VPN service, how do I have confidence that someone who my connection passes through won't decide to just blacklist/throttle all VPNs?

 

Plus bypassing this stuff is likely to be in violation of the various relevant ToS you have agreed to, and I don't partuclarly fancy having accounts suspended for this reason

 

Quote

You can also get some pretty solid deals from reputable companies

Which VPN companies do you consider reputable?

 

Quote

and they're end up costing as much as a couple coffee's a month.

Unless I want to commit to it for years at a time, those would have to be very expensive coffees. (Incidentally I'm in the UK.)

 

 

But no. The main reason I don't like VPN services is some very sketchy advertising techniques which are on the border of questionable and completely wrong. A single example: It is simply untrue that your connections are unencrypted when not using a VPN. Unless you are using very old websites they are all SSL encrypted.

[BuckGup]

5 hours ago, Kisai said:

There really is no such thing as a "log-less" VPN unless it was designed to run entirely on public key credentials (in a sense, a SSH socks tunnel) and the machine has explicitly had all logging sent to /dev/null , hard to pull off but do-able.

 

However that doesn't mean your VPN adds any value. If the point of the VPN is privacy (as opposed to "doing soft crimes anonymously" which is what most VPN's are really used for, eg piracy, porn and government censorship dodging) then the actual machine has to be setup outside the legal jurisdiction you exist in, and only setup via a proxy (eg someone in that country) who is actually paying for it. That's highly doubtful. The average VPN pretty much is used to dodge geoblocking and ISP tampering, which there really is no law preventing it, so it slides under the radar. If you're paying for it with a credit card, you're aren't anonymous, and if you used a burner email address, that isn't anonymous either. There literately has to be no communication between the one who sets it up and the one who uses it.

 

The reason all these VPN services exist at all was to help people pirate movies/get around geoblocking, and any secondary reason is touted as privacy, even if those privacy features are really intended to block government censorship. Like at least one VPN ISP out there literately exists to enable people in one middle-eastern country watch porn and youtube, which is banned.

 

Like, if you really want to have a VPN, go right ahead, but non-enterprise VPN's really don't protect you from anything if it's convenient to use and pay for.

Yes and no. There are ways you can be pretty secure, nothing is 100% though. You need to get a car with no plates and swap the tires. All while wearing one of those hyper realistic masks and gloves with fake fingerprints. Drive to a vacant area and swap masks and prints. Then go to a coffee shop and sit outside and connect to the public wifi with a burner laptop you got from a public auction as a private buyer. You'll have to secure it yourself but a wipe and tails should be good and make sure to spoof your mac as well. Once you are connected to the wifi connect to a free VPN through a SOCKS5 proxy and then connect to tor. The free VPN might seem silly but what it does is secure you from anyone at the coffee shop spying on you but also masks you in a group of public IPs. Which you then are connected to Tor who has it's own safety measures at play. Finally get a VPN outside of the 14 eyes countries, use cleaned bitcoins or monero to pay, burner email or proton if you trust them, and then you should be good to go. Afterwards burn the car with all the evidence inside or have it crushed at a junk yard. This is a way you can cover your in person meta-data and be secure online

[Statik]

2 hours ago, pythonmegapixel said:

Tell me what data I should have that I should trust to some random company who sells VPN services, but not to my ISP?

If you want to make that argument, you could also theoretically make the argument of why should you trust your data to a random company that gives you internet? I don't like the fact that my ISP has access to, and the right/ability to sell my private browsing data. I don't agree with that on any level. Nor do I agree with the fact that my ISP can take my data and use it to help censor the internet, varying on a users location.

 

EDIT: I also like the added layer of protection/privacy that a VPN offers from 3rd parties. You don't get that from not using a VPN.

 

Quote

Simply blacklisting VPNs is easily possible (my school has done it for years: Netflix sometimes does it; many minecraft servers do it) and if too many people switch to VPNs then ISPs will start doing it as well.

"If we take our right to privacy into our own hands, they'll take that away from us". That is the weakest argument I've heard on this topic.

Quote

 

If I'm going to pay for a VPN service, how do I have confidence that someone who my connection passes through won't decide to just blacklist/throttle all VPNs?

 

Plus bypassing this stuff is likely to be in violation of the various relevant ToS you have agreed to, and I don't partuclarly fancy having accounts suspended for this reason

What are you talking about? Bypassing what? Tell me one ToS that using a VPN violates. You're acting like VPNs are shady/illegal.

 

 

Quote

Which VPN companies do you consider reputable?

Express, Nord (for sure), and I believe Proton VPN are all confirmed to not keep user logs, and the former two are two of the most popular/reputable options out there.

 

If they were security risks, sold/stored/leaked data, I'd think it'd would be unlikely that the former two would have 10's of millions of downloads.

Quote

 

Unless I want to commit to it for years at a time, those would have to be very expensive coffees. (Incidentally I'm in the UK.)

Most people don't buy VPNs for a single month... It's kind of pointless unless you have a very specific, niche use. So if you buy Nord for 1 year, it's like ~$6/mo. I buy coffee for $2...

 

Quote

 

But no. The main reason I don't like VPN services is some very sketchy advertising techniques which are on the border of questionable and completely wrong. A single example: It is simply untrue that your connections are unencrypted when not using a VPN. Unless you are using very old websites they are all SSL encrypted.

While I agree that some VPN marketing techniques are iffy at best, I feel any of the big names in the industry offer plenty of indepth explanations on their websites which clarify things much more. Plus I'm a believer that if you spend money on a product that you didn't do any research/reading into, then you're wrong.

 

Pretty much every VPN site I've looked at has something along the lines of a "How it works" tab that explains that it encrypts your data from 3rd parties, and companies like ISPs, Wifi network owners, etc.

 

I feel like you're also approaching this from more of a security frame of mind in some instances, and not privacy as well.

[pythonmegapixel]

5 minutes ago, Statik said:

If you want to make that argument, you could also theoretically make the argument of why should you trust your data to a random company that gives you internet? I don't like the fact that my ISP has access to, and the right/ability to sell my private browsing data. I don't agree with that on any level. Nor do I agree with the fact that my ISP can take my data and use it to help censor the internet, varying on a users location.

Well I don't like the fact that if I pay for a VPN the VPN company has access to my personal data and habits. They might commit not to selling it but still I don't know why I should trust them.

 

Unless I'm going to run my own cables and operate my own DNS facilities as well as everything else an ISP has then I pretty much have to trust a commerical ISP (not with my browsing history, but with my name, phone number, address, credit status etc). But I don't have to trust a VPN company. And trusting one company with a set of data is better than trusting two companies with the same set of data.

 

5 minutes ago, Statik said:

I feel like you're also approaching this from more of a security frame of mind in some instances, and not privacy as well.

5 minutes ago, Statik said:

EDIT: I also like the added layer of protection/privacy that a VPN offers from 3rd parties. You don't get that from not using a VPN.

Fair enough... but pretty much all these companies can track you anyway. If you have a user account with them then it's obvious, but also... browser cookies containing advertising IDs, your purchase history on eBay and Amazon and so on.

 

5 minutes ago, Statik said:

"If we take our right to privacy into our own hands, they'll take that away from us". That is the weakest argument I've heard on this topic.

No, seriously. My ISP already blacklists a few VPNs, and no doubt more are to come.

A valid reason not to use a VPN is that you can't.

 

5 minutes ago, Statik said:

What are you talking about? Bypassing what? Tell me one ToS that using a VPN violates. You're acting like VPNs are shady/illegal.

Netflix ToS:

You agree not to: circumvent, remove, alter, deactivate, degrade or thwart any of the content protections in the Netflix service - I assume this includes the protections which prevent you from viewing Netflix in the wrong region; why wouldn't it?

 

Hulu ToS:

You may not either directly or through the use of any device, software, internet site, web-based service, or other means remove, alter, bypass, avoid, interfere with, or circumvent.... any digital rights management mechanism, device, or other content protection or access control measure associated with the Content including geo-filtering mechanisms. - This one explicitly prevents use of bypasses for geoblocks

 

Spotify ToS:

The following is not permitted for any reason whatsoever: ... circumventing any technology used by Spotify, its licensors, or any third party to protect the Content or the Service

 

Other services have similar clauses.

 

5 minutes ago, Statik said:

Express, Nord (for sure), and I believe Proton VPN are all confirmed to not keep user logs, and the former two are two of the most popular/reputable options out there.

I mean, let's just gloss over the fact that VPNs, even reputable ones, have had data breaches.

 

5 minutes ago, Statik said:

If they were security risks, sold/stored/leaked data, I'd think it'd would be unlikely that the former two would have 10's of millions of downloads.

Most people don't buy VPNs for a single month... It's kind of pointless unless you have a very specific, niche use. So if you buy Nord for 1 year, it's like ~$6/mo. I buy coffee for $2...

That still isn't cheap though for many people. The coffee or the VPN.

 

5 minutes ago, Statik said:

While I agree that some VPN marketing techniques are iffy at best, I feel any of the big names in the industry offer plenty of indepth explanations on their websites which clarify things much more. Plus I'm a believer that if you spend money on a product that you didn't do any research/reading into, then you're wrong.

 

Pretty much every VPN site I've looked at has something along the lines of a "How it works" tab that explains that it encrypts your data from 3rd parties, and companies like ISPs, Wifi network owners, etc.

But all of this fundementally implies that it is unsafe not to use a VPN. Which it isn't.

 

 

 

 

 

Incidentally I think us coming from different countries has an awful lot to do with this. In the UK our data protection regulations are extremely strict and there are enormous fines for using customer data in any way not explicitly agreed to. This means that ISP terms and conditions specifically say they do not sell data, and if they do sell data then they can be charged enormous (sometimes bankrupting) fines. They won't risk it.

 

For example, my ISP's privacy policy contains things such as giving the customer's address to the contractor who connects you to the network at the start of the contract (obviously a necessary thing).

 

[Kisai]

3 hours ago, BuckGup said:

Yes and no. There are ways you can be pretty secure, nothing is 100% though. 

Yeah, but the people who think they are anonymous and then use their credit card and a email+password they use for anything else is probably higher than the amount of people who pay a third party anonymously to setup and manage one.

 

Like, to be blunt, if you're gonna crime, the VPN that advertises it doesn't track you, does need to keep a customer database, thus it can be queried by law enforcement. These "leaks" just show that they can be completely careless.

[Statik]

1 hour ago, pythonmegapixel said:

Well I don't like the fact that if I pay for a VPN the VPN company has access to my personal data and habits. They might commit not to selling it but still I don't know why I should trust them.

 

Unless I'm going to run my own cables and operate my own DNS facilities as well as everything else an ISP has then I pretty much have to trust a commerical ISP (not with my browsing history, but with my name, phone number, address, credit status etc). But I don't have to trust a VPN company. And trusting one company with a set of data is better than trusting two companies with the same set of data.

 

I suppose that's a good point, but I don't like the added risk/lack of privacy that I get from not having a VPN.

Quote

Fair enough... but pretty much all these companies can track you anyway. If you have a user account with them then it's obvious, but also... browser cookies containing advertising IDs, your purchase history on eBay and Amazon and so on.

I agree, but there's also methods you can use to minimize this. I by all means don't think a VPN is a one stop shop, there's several layers and things you should to do minimize these things.

Quote

 

No, seriously. My ISP already blacklists a few VPNs, and no doubt more are to come.

A valid reason not to use a VPN is that you can't.

I think that's wrong. In Canada I've never heard of a company blacklisting VPNs. I wouldn't give my buisness to a company that bans VPNs, that screams shady, and that they have malicious intent with your data.

Quote

 

Netflix ToS:

You agree not to: circumvent, remove, alter, deactivate, degrade or thwart any of the content protections in the Netflix service - I assume this includes the protections which prevent you from viewing Netflix in the wrong region; why wouldn't it?

 

Hulu ToS:

You may not either directly or through the use of any device, software, internet site, web-based service, or other means remove, alter, bypass, avoid, interfere with, or circumvent.... any digital rights management mechanism, device, or other content protection or access control measure associated with the Content including geo-filtering mechanisms. - This one explicitly prevents use of bypasses for geoblocks

 

Spotify ToS:

The following is not permitted for any reason whatsoever: ... circumventing any technology used by Spotify, its licensors, or any third party to protect the Content or the Service

 

Fair point, I don't know how I didn't think of Netflix. However I don't know of any instance of them actually banning anyone. They also can't necessarily prove that you are trying to access geo-locked content. If they determine you're using a VPN, for all intensive purposes you're in that actually country, just connecting to a "local" server. They can't actually prove your current location, so they can't really do anything.

Quote

I mean, let's just gloss over the fact that VPNs, even reputable ones, have had data breaches.

Everywhere has data breaches. So do ISPs.. If you have a VPN that stays true to their no logs policy, the best they're going to get is a username/password.

Quote

 

That still isn't cheap though for many people. The coffee or the VPN.

I'm not here to debate people's financial situation. It's a service that you pay for, what are you expecting? A year for 50c? The point I'm trying to make, is in the grand scheme of things, compared to people phone bills, internet bills, hobbies, etc, it's really pennies on the dollar. They're not outrageously priced imho.

 

Quote

 

But all of this fundementally implies that it is unsafe not to use a VPN. Which it isn't.

This is true, and also false. You're not safe on the internet, and giving every website you visit, person you talk to, etc, etc, etc, a way in. It gives me a piece of mind my VPN is an extra security and privacy layer.

 

Quote

 

Incidentally I think us coming from different countries has an awful lot to do with this. In the UK our data protection regulations are extremely strict and there are enormous fines for using customer data in any way not explicitly agreed to. This means that ISP terms and conditions specifically say they do not sell data, and if they do sell data then they can be charged enormous (sometimes bankrupting) fines. They won't risk it.

 

For example, my ISP's privacy policy contains things such as giving the customer's address to the contractor who connects you to the network at the start of the contract (obviously a necessary thing).

 

I honestly have zero ideas on the laws of other countries, and the ins/outs/loopholes, or the actual reality of the situation, so I can't really weigh in on the topic.

 

However, companies like Facebook, Google, etc, can harvest and do whatever they want with your data, UK or not, so I don't exactly have the confidence that other companies (like ISPs) aren't also doing shady business, that's really hard to trace back to them at the end of the day.