Your VPN may be worthless

You may have heard that VPN provider Perfect Privacy found a massive security hole in most services — one can de-anonymizes users, thus rendering it useless.

Two weeks have passed and most affected providers still haven’t fixed the problem, called “Port Fail.”

Perfect Privacy told Engadget via email, “We have not tested this again after the fact so we can make no definite statement on the current number of affected VPN providers.” This means that the majority of VPN users may as well not be using one, which is bad news for people whose safety and security rely on keeping their IP address private — or those who just want to safely use public wi-fi.

Perfect Privacy urges “anyone using a VPN service to ask their support desk whether this issue has been fixed.”

With a VPN (Virtual Private Network) the user’s Internet connection travels encrypted from computer to VPN server; from there the user’s connection travels unencrypted to their final destination (a website). This way, websites only see the VPN’s IP address and not the user’s.

Perfect Privacy tested a sampling of nine top VPNs and notified the five it found to be vulnerable before releasing the news November 26th. But only Ovpn.to and nVPN changed the settings necessary to block Port Fail attacks.

Popular service Private Internet Access (PIA) initially told press it had fixed the issue, but then recanted its statement of a fix. PIA currently has 3093 servers in 35 locations across 24 countries. Lifehacker lists PIA as number one in its “Five Best VPN Service providers,” along with TorGuard, which also allows port forwarding but is not vulnerable to the attack.

The fixes are distressingly simple, and were published on Perfect Privacy’s blog along with the November disclosure. The company said via email, “The easiest fix for affected VPN providers is to add firewall rules when a client connects that blocks access from client real IP to port forwardings that are not his own.” They explained, “The other option is to assign different entry and exit IPs.”

Perfect Privacy’s blog post said its customers are not affected by Port Fail.

When targeted by the “Port Fail” attack, the victim has no way of knowing they’ve lost their anonymity.

For Port Fail to work, the attacker uses the same VPN provider as the target and simply sets up port forwarding. It doesn’t matter if the victim has port forwarding turned on or not.

The attacker can get the real IP addresses of any user on the same VPN service by getting the victim to click a link; it then redirects the victim to a port under the attacker’s control.

What can attackers find out about you by getting your real IP address with Port Fail?

They can identify your internet service provider (ISP, such as Comcast or Sonic.net). Your ISP knows exactly who you are, and while they’re usually reluctant to share that information, they are required to divulge your identity and personal information if they get a court order to do so.

Your IP address reveals where you’re located on a map, usually down to the neighborhood, so the Port Fail attacker will know that, too. Port Fail also allows attackers to see which websites you visit, and how often.

It’s not a stretch to think that Port Fail would be a gem in the private spying stashes of the RIAA or MPAA, as it apparently uncloaks torrent users quite easily.

It may already be in the NSA’s arsenal. The US government already has legal standing for cyberspying on people outside the US, and possible they’re willing to go on someone merely being perceived as coming from outside the US — like when someone uses a foreign VPN.

Last February the Justice Department proposed a new kind of warrant for domestic VPN spying, for “remote access” to devices and desktops when their locations are hidden “through technological means.”

Appreciate that people are aware and ask about this! We don’t do port forwarding and are therefore not affected https://t.co/FvWq3amiEv

— F-Secure Freedome (@FreedomeVPN) November 27, 2015

There are hundreds of VPN services worldwide; users should find out if the service they use provides port forwarding and ask whether Port Fail has been fixed. We recommend that users direct anyone with questions to Perfect Privacy’s remediation post.

After that, if your VPN service hasn’t closed the Port Fail hole… It’s time for a new VPN.

Source: Perfect Privacy

Bipartisan education bill makes computer science a priority

Yesterday, the president signed a new education bill designed to replace the 13-year old No Child Left Behind act, reducing federal controls on state education systems — but it does something else, too. The Ever Student Succeeds act places computer science on the same level as other “well-rounded” subjects. Coding and computer literacy is now just as important as math and science.

It sounds almost like a small change, but the bill will have a huge impact: kind of education organizations like Code.Org have been pushing for is officially considered fundamental coursework by the federal government. The caveat, however, is that implementing computer science courses isn’t mandatory — most states tend to copy federal standards, but the law doesn’t explicitly state that they have to.

Still, the new bill represents a big step forward towards making coding and computer science a regular part of our children’s education, and that’s a good thing.

[Image credit: Getty Images]

Source: Wall Street Journal

Review: The SteelSeries Nimbus is a Convenient, Affordable Bluetooth Controller for Apple TV and iOS Devices

There’s a range of Made for iPhone-compatible Apple-approved Bluetooth controllers available, all of which will work with the new Apple TV, but the SteelSeries Nimbus is the only controller that was designed specifically for the Apple TV in partnership with Apple.

As such, it’s been heavily marketed by Apple and it’s sold alongside the Apple TV as an accessory in Apple Stores. We went hands-on with the SteelSeries Nimbus to figure out whether it’s worth its $50 price tag and if it’s a must-have gaming accessory for the new fourth-generation Apple TV.

Design

The Nimbus is similar in size and design to the Stratus XL, an earlier controller SteelSeries released. It looks like a cross between an Xbox One controller and a PlayStation 4 controller, with a shape that’s close to the Xbox controller but a PlayStation-style layout. It’s also very similar to many existing Made for iPhone controllers like the popular Mad Catz C.T.R.L.i.

If you’ve used one Made for iPhone controller, you’ve essentially used them all. The Nimbus is not much different than the rest of the available controllers on the market, so choosing a controller to purchase really comes down to preference for things like size, button layout, trigger shape, and overall design.

On the Nimbus, there’s a d-pad at the top, located across from four action buttons. Two analog joysticks sit at the bottom, adjacent to one another as on the PS4 controller. In the middle, there’s a large Menu button, and at the back, there’s a Bluetooth button, a Lightning port for charging, and a “Hold” button that toggles the power on and off. There are two triggers on each side, along with shoulder buttons above those.

A lot of early Made for iPhone controllers were expensive and had a poor build quality, but over the last several months, things have improved. I was pleasantly surprised with the quality of the SteelSeries Nimbus, especially at it’s $50 price point. It has a solid feel in the hand and it seems like a product that’s going to hold up well to years of heavy use.

Read more