HomeTechnologyTech newsUS government agencies eyeing VPN service loopholes

US government agencies eyeing VPN service loopholes

The emergence of an ad looking for flaws zero day (or day zero, those unknown when since the software releases) on three popular VPN services sparked a warning about the possible interest of government agencies in exploring openings in this type of platform. The order came from Zerodium, a company that works in the purchase of loopholes of this type, and is focused on the services of Surfshark, NordVPN and ExpressVPN, focusing on vulnerabilities that allow locating users.

The announcement is clear and, like so many others, it was made by Twitter. According to the post, the company is looking for openings that allow it to obtain the IP address and other information of VPN users, as well as executing codes remotely. There is no interest, according to Zerodium, in failures that allow privileges to be escalated on the user’s machine, indicating that the interest is in the user and not necessarily in the data stored on devices.

Taking into account the company’s official clients, government agencies and law enforcement agencies, the most straightforward conclusion is that the openings would be used in espionage operations or investigations. Authorities who use Zerodium’s services are mainly in Europe and North America, traditionally using such openings in their operations. Despite the clarity of the request, it’s clear that the cybersecurity company didn’t elaborate on the motives behind the search, not even leaving the Twitter post open to third-party responses.

Want to catch up on the best tech news of the day? Access and subscribe to our new youtube channel, Canaltech News. Everyday a summary of the main news from the tech world for you!

Together, the three services concentrate tens of millions of users around the world, with more than 11,000 servers spread across the globe. Meanwhile, the request follows a recent alert from the US government’s National Security Agency (NSA) that Russian criminals use Surfshark and NordVPN in launching brute-force attacks. In late 2020, the FBI also issued a similar warning about a fake news campaign created by Iranian thugs trying to pass themselves off as members of the American extreme right.

Officially, Zerodium claims to directly moderate the use of vulnerabilities and exploits by its customers, with only a small number of them having access to tools that involve loopholes. zero day. The values ​​offered in this case were not disclosed, but in some cases, they may exceed the $1 million mark, as was the case with an opening that allowed remote code playback in mode sandbox from the Google Chrome browser.

Of the target companies, Surfshark was the only one to respond to contacts in the international press, claiming to adopt the highest security practices to protect the identity of its customers. The company criticized Zerodium’s efforts to take advantage of security holes and said it worked cautiously on resolving vulnerabilities, with appropriate rewards being paid to those who discover them.

The cybersecurity company itself did not comment on the matter.

Related news