I am currently investigating and reverse engineering free VPNs for a master thesis, and just came across something I thought I’d share. Not sure if I’ll name-drop the VPN that this code is from, but it’s not the one mentioned within the hardcoded links… Nor do I encourage visiting any of the links in the screenshot.

I’m sharing this as a warning as to never use free vpns! They are most often the opposite of what they promise to be. (by free I do not mean the free versions of premium services). But either way; be careful about your VPN choice, as they have access to a lot of sensitive data. I’m sure most peeps here know of this already, but next time you hear someone using a free vpn, let them know…

This first image/code was sitting inside a file called NetworkModule, with some hella weird external links.

  1. addrDOTcx, seems to have been linked to malware? Comes up flagged as malicious a few times on VirusTotal.
  2. freevpnDOTzone, seems to be another free possible malicious VPN service, might investigate this one later.
  3. bigbrolookDOTcom, seems to longer be a registered domain. But wtf? Was this VPN service linked to p*rn??
IMAGE HERE; Don't visit these links unless you know what you're doing.

Furthermore, there is this interesting find; Now I am no expert coder, frankly quite the amateur. But does the below code really mean what I think it does? Seems like it could be creating a fake connection? Is used once here;

Stay safe 🌻

  • TerribleTortoise@lemmy.world
    0·
    1 年前

    The addAddress call may just be configuring the local side of the VPN. It’s hard to know without looking at the rest of the code.
    The general workflow when establishing a VPN connection is:

    • open a socket to the destination VPN service (ProtonVPN, or whatever suspect service).
    • configure parameters such as DNS, split tunneling, and which networks to route over the VPN (generally everything from your local system, except the VPN connection itself).
    • update the local routing so traffic starts flowing over the VPN.

    addAddress may just be part of the configuration. A very cursory search suggests that OpenVPN may be being used as the underlying VPN implementation framework (not uncommon).