Jerry, Author at Safernet

New BrakTooth Flaws Leave Millions of Bluetooth-enabled Devices Vulnerable

Post On: 24 October, 2021 By : Jerry

Braktooth is the name given to a new set of security vulnerabilities that affect Bluetooth devices and can enable a hacker to execute arbitrary code or crash devices via denial-of-service (DoS) attacks.

Braktooth (referring to the Norwegian word “Brak” which translates to “crash”) contains 16 weaknesses which span across 13 Bluetooth chipsets from 11 vendors such as Intel, Qualcomm, Zhuhai Jieli Technology, and Texas Instruments, covering an estimated 1,400 or more commercial products, including laptops, smartphones, programmable logic controllers, and IoT devices.

Braktooth was discovered by cybersecurity researchers from SSET (Automated Systems SEcuriTy) at the Singapore University of Technology and Design (SUTD).

“All the vulnerabilities […] can be triggered without any previous pairing or authentication,” the researchers noted. “The impact of our discovered vulnerabilities is categorized into (I) crashes and (II) deadlocks. Crashes generally trigger a fatal assertion, segmentation faults due to a buffer or heap overflow within the SoC firmware. Deadlocks, in contrast, lead the target device to a condition in which no further BT communication is possible.”

Of the 16 vulnerabilities, the most severe is CVE-2021-28139, which affects the ESP32 SoC used in many Bluetooth-based appliances ranging from consumer electronics to industrial equipment. Due to a lack of an out-of-bounds check in the library, an attacker can inject malicious code on vulnerable devices.

Other Braktooth vulnerabilities can result in Bluetooth functionality getting entirely disabled, or cause a DOS condition in laptops and smartphones employing Intel AX200 SoCs. “This vulnerability allows an attacker to forcibly disconnect slave BT devices currently connected to AX200 under Windows or Linux Laptops,” the researchers said. “Similarly, Android phones such as Pocophone F1 and Oppo Reno 5G experience BT disruptions.”

Bluetooth speakers, headphones, and audio modules can be sent into a bricked-state byBraktooth, where the user will be unable to turn them back on. The Braktooth attacks can be carried out using a readily available Bluetooth packet sniffer that costs less than $15.

A handful of companies including Espressif and Infineon have released firmware patches to protect vulnerable devices, while Intel, Qualcomm, and others are still investigating and a patch is in the works. Texas Instruments doesn’t intend to release a fix unless “demanded by customers.”

Braktooth Vulnerability Analysis

Note: This analysis was carried out by ASSET.

The attacker only requires (1) a cheap ESP32 development kit (ESP-WROVER-KIT [31]) with a custom (non-compliant) LMP firmware and (2) a PC to run the PoC tool. The PoC tool communicates with the ESP32 board via serial port (/dev/ttyUSB1) and launches the attacks according to the specified target BDAddress () and exploit name parameter ().

Below are the devices used for evaluation of Braktooth. The sample code is provided by vendor to test the development board. This is not applicable (N.A) on products running a fixed application.

Below is a summary of new vulnerabilities and other anomalies found (Vx: Vulnerability, Ax: Non-compliance) which make upBraktooth.

A summary of Braktooth appears in Table 2. In each row, we use the prefix V to identify a security vulnerability and A to indicate an anomalous behaviour (i.e., faulty target responses) that deviates from the Core Specifications [27]. Moreover, Table 2 outlines the respective CVEs, affected devices, protocol layers, and the violated compliance. In summary, we discovered 16 new security vulnerabilities belonging toBraktooth. For all the discovered vulnerabilities, we have followed a responsible disclosure process.

The impact of our discovered vulnerabilities is categorized into (I) crashes and (II) deadlocks. Crashes generally trigger a fatal assertion, segmentation faults due to a buffer or heap overflow within the SoC firmware. Deadlocks, in contrast, lead the target device to a condition in which no further BT communication is possible.

This may happen due to the paging scan being forcibly disabled (V16), state machine corruption on V6 or entirely disabling BT functionality via arbitrary code execution (ACE) on V1. Our results affect popular BT vendors (i.e, Intel, Qualcomm, Cypress, Texas Instruments) and relatively less known (i.e., Bluetrum, Jieli Technology, Harman), which are still employed in many consumers products such as BT speakers, keyboards, toys, etc.

V1 affects ESP32, which is used in many products ranging from consumer electronics to industrial equipment such as programmable logic controllers (PLCs). Hence, the impact is significant, as the attacker only requires knowledge of the target BDAddress to launch the attack. Indeed, all the vulnerabilities V1-V16 can be triggered without any previous pairing or authentication. Moreover, the impact of V1-V16 reaches beyond the devices listed in Table 2, since any other BT product employing an affected SoC is also vulnerable.

Multiple Link Manager Protocol (LMP) flooding attacks (e.g., V4, V12) and V15 were detected across SoCs from different BT vendors. Since the affected vendors are majors in their fields (i.e., Intel & Qualcomm), it indicates that there is a lack of flexible tools for over-the-air testing even in 2021. Besides, the Core Specifications only allows a limited “LMP test mode” [27] that restricts the SoC to operate with few LMP procedures.

The most critical vulnerability ofBraktooth (V1 in Table 2 – 8.1) affects ESP32 SoC [30], which is used in many Wi-Fi and Bluetooth IoT appliances such as Industry Automation, Smart Home, Fitness, etc. The attack is illustrated in Figure 3. A lack of out-of-bounds check in ESP32 BT Library [9] allows the reception of a mutated LMP_feature_response_ext. This results in the injection of eight bytes of arbitrary data outside the bounds of Extended Feature Page Table (“E. Features Table” in Figure 3).

An attacker, which knows the firmware layout of a target device, can write a known function address (JMP Addr.) to the offset pointed by Features Page (“Feat. Page” in the LMP_feature_response_ext packet) field. It turns out that the BT Library stores some callback pointers within the out-of-bounds Features Page offset and such a callback is eventually invoked during the BT connection.

While exploiting this vulnerability, we forced ESP32 into erasing its NVRAM data (normally written during product manufacturing) by setting JMP Addr. to the address of nvs_flash_erase. Such erase function is always included in ESP32 SDK [7] and therefore, it is present in any ESP32 firmware. Similarly, disabling BT or BLE can be done via esp_bt_controller_disable and Wi-Fi via disable_wifi_agc.

Additionally, general-purpose input/output (GPIO) can be controlled if the attacker knows addresses to functions controlling actuators attached to ESP32. As expected, this has serious implications if such aBraktooth attack is applied to Bluetooth-enabled Smart Home products.

Protection

SaferNet is the perfect solution to the cybersecurity issues that individuals, families, and businesses face today. It not only connects every device using a secure, 24/7 always on, military grade VPN, but it also stops outside cyberthreats, malware and viruses as well. On SaferNet, all users are protected anywhere in the world, all the time, on any cellular or Wi-Fi network. In addition to SaferNet’s VPN and cyber protection, it also offers a range of employee or parental/family internet controls including internet filtering, monitoring, scheduling, and blocking access to websites or even entire website categories

Typically, a business or family would need 3 separate services for a VPN, Malware Protection, and Internet Controls; SaferNet offers all 3 features in one service. SaferNet truly is an endpoint security presence that can be implemented in minutes around the world, on phones, laptops, tablets, and computers at an economical price point that caters to all sizes of businesses and families. SaferNet guarantees a smooth setup and installation process that takes only minutes, and an easily accessible control hub for you to monitor all your employee’s or family members devices; including activity, time spent online, and threats blocked.

SEC & FBI Warn Of Hurricane Ida Identity Theft Scams

Post On: 24 October, 2021 By : Jerry

The US Securities and Exchange Commission as well as the Federal Bureau of Investigation have warned citizens and investors to be “extremely wary” of both potential investment and identity theft scams related to the aftermath of Hurricane Ida.

The alert to investors was posted from SEC’s Office of Investor Education and Advocacy, which regularly issues warnings about the latest fradulent schemes prevalent in the country.

Scammers and cybercriminals are likely to set their targets on individuals and companies who recieve compensation from insurance companies as a result of damage done by Hurricane Ida.

“For example, the SEC brought a number of enforcement actions against individuals and companies who made false and misleading statements about alleged business opportunities in light of damage caused by Hurricane Katrina in 2005,” the SEC warning reads.

“Some of those cases involved pump-and-dump scams where fraudsters used bogus “news” to pump up the stock price of small companies so they could sell their own shares at artificially high prices.”

To protect yourself from investment fraud attempts, you should ask anyone approaching you with an investment opportunity if they’re licensed and if their investment is registered with the SEC or with a state.

“Take a close look at your entire financial situation before making any investment decision, especially if you are a recipient of a lump sum payment. Remember, your payment may have to last you and your family for a long time.”

The SEC alert was released just after a similar warning by the FBI’s New Orelans office, which issued two warnings in the last week – Both around alerting the public about an increased risk of fraudsters trying to capitalize on the Hurricane Ida natural disaster and carry out identity theft.

“Unfortunately, hurricane or natural disaster damage often provides opportunities for criminals to scam storm victims and those who are assisting victims with recovery,” the FBI warned.

The FBI also provided a set of measures those impacted by a natural disaster can take to avoid getting scammed, including to:

Not respond to unsolicited (spam) emails.
Be skeptical of individuals representing themselves over email as officials soliciting donations.
Not click on links within an unsolicited email.
Be cautious of emails claiming to contain pictures in attached files, as the files may contain viruses—only open attachments from known senders.
Not provide personal or financial information to anyone who solicits contributions; providing such information may compromise your identity and make you vulnerable to identity theft.
Be cautious of emails claiming to offer employment for which you did not expressly apply.
Thoroughly research housing ads before sending money to a potential landlord.

The Dangers of Identity Theft

Identity Theft can be absolutely devastating for an individual. Usually, in the world of malware, we know certain things can be harmed. Our devices may need to be replaced, we may lose access to accounts for a few days or even forever, we may even need to pay a ransom for access to our data. The point is, with most types of Malware, we can eventually rebuild, though it may take longer than we anticipate. The fallout from identity theft is much longer.

Once your stolen information is used once, it can take anywhere from a few days to six months for that one incident. But your information is out there for a very, very long time. This means you could end up dealing with identity theft for many years, even decades.

Identity Theft has been around for a very long time and predates our modern technology by thousands of years. There have always been individuals that try to impersonate others for their own gain, financial or otherwise. However, the internet’s birth and wide adoption have led to new attack vectors, dwarfing any possible past attempts.

Now more than ever do we have data tied into our personal identity. Email addresses, banking numbers, phone numbers, social security numbers, home addresses – All of these and more form a picture of us as lines in a database.

And when this information falls into the wrong hands, it can do a lot of damage. Bank accounts can be drained, and your credit rating can get rattled; you can end up with medical bills or even a criminal record. The list of potential mishaps that can arise from identity theft is endless.

To hackers, identity theft represents a lucrative stream of income, and they can very easily cover their tracks. After they have seized personal information, they sell it on the dark web. This information can be sold over time, repeatedly, meaning that if you notice your identity has been stolen and used, it can be used in several instances over a long period of years.

There are some guidelines from the US government in discovering if you are a victim of identity theft if it is not immediately obvious:

You stop receiving your regular bills and credit card statements.
You receive statements for accounts you never opened.
Debt collectors start calling you day and night about debts you’ve never heard of.
The IRS alleges you failed to report income for a company you never worked for.
You see withdrawals/charges on your bank or credit card statement that you didn’t make.
You try to file your taxes only to discover that someone else beat you to it.
You try to file your taxes and find someone claimed your child as a dependent already.
Your credit report includes lines of credit you never opened.
Your credit score fluctuates wildly and for no apparent reason.
The most obvious sign—you receive a notification that you’ve been the victim of a data breach.
If you are unsure, it is always best to check with the authorities on the US government’s identity theft website.

Protection

In some cases, a victim cannot be faulted for identity theft. For example, those affected by the data breach handed their information over to companies in good faith in the story above. Unfortunately, these companies, or more specifically the vendor, failed in protecting this information. However, many other times, business owners and families are singled out and targeted in their offices and homes.

For times like these, it is critical that you have the right tools to protect yourself. One of these tools is SaferNet.

Notorious Revil Ransomware Gang Resurfaces After Hiatus

Post On: 24 October, 2021 By : Jerry

The servers for the notorious ransomware strain REvil Ransomware have suddenly switched back online following a 2 month absence. The REvil Ransomware gang is one of the most profilic cybercriminal gangs, and operates from Russian. The gang is accused of leading a flurry of attacks in the past few years, with attacks in the last 12 months soaring. One of the most notable attacks this year was against meat supplier JBS, who paid a $11 million ransom to the gang.

On July 2nd, the REvil ransomware gang, aka Sodinokibi, used a zero-day vulnerability in the Kaseya VSA remote management software to encrypt approximately 60 managed service providers (MSPs) and over 1,500 of their business customers. The gang demanded $5 million from MSPs in exchange for the decrypter, and $70 million for a master decrypter for all Kaseya victims.

Later that week, the gang faced increasing pressure from law enforcement as US President Joe Biden held a summit with Russian Prime Minister Vladimir Putin, who agreed to tackle ransomware gangs within Russian borders.

Shortly after the summit, the REvil Ransomware gang dissapeared, and their servers and infrastructure were shut down. At the time, it left victims who wanted to negotiate with no clear path to do so.

Soon, Kaseya recieved the master decrypter from a “trusted third party”, which enable victims to decrypt all affected devices. It is still unknown who supplied this, though it is believed that Russian intelligence received the decryption key from the threat actors and passed it along to the FBI as a gesture of goodwill.

While the cybersecurity community were in good spirits following the apparent downfall of REvil Ransomware, both the Tor payment/negotiation site and REvil’s Tor ‘Happy Blog’ data leak site suddenly came back online this week.

The most recent victim on the blog was added on July 8th, 2021, just five days before REvil’s mysterious disappearance.

The Tor negotiation site is not yet fully operational, though shows a login screen which does not allow victims to log in.

The gang’s decoder is still offline at this time.

It is unclear what’s next for REvil Ransomware, but it seems that celebrations this summer were premature.

REvil Ransomware Analysis

REvil Ransomware is a Ransomware-as-a-Service (RaaS), meaning it can be sold on a subscription basis and is usable by just about anybody. In 2020, it extorted large amounts of money for corporations and individuals. According to researchers, it is the most widespread ransomware strain. Groups using have a knack for shaking down businesses that don’t meet their demands, often through threats or leaking dating.

REvil Ransomware, also known as Sodinokibi, first appeared in April 2019 and rose to prominence after another RaaS gang called GandCrab shut down its service. REvil was first advertised on Russian-language cybercrime forums. The main actor associated with advertising and promoting REvil ransomware is called Unknown aka UNKN. In the early days of REvil, researchers and security firms identified it as a strain of GandCrab, or at least established multiple links between the two. An alleged member of the group, using the handle Unknown, confirmed in an interview that the ransomware was not a new creation and that it was built on top of an older codebase that the group acquired.

The group behind REvil Ransomware and other groups selling RaaS often do so on a commission basis. Usually, this means a cut of between 20% and 30% of the money earned through infecting victims with ransomware.

In 2020, the IBM Security X-Force Incident Response reported that 1 in 3 Ransomware infections were caused by REvil Ransomware.

In February 2021, the REvil ransomware operation posted a job notice where they were looking to recruit people to perform DDoS attacks and use VOIP calls to contact victims and their partners.

In March, a security researcher known as 3xp0rt discovered that REvil has announced that they were introducing new tactics that affiliates can use to exert even more pressure on victims.

These new tactics include a free service where the threat actors, or affiliated partners, will perform voice-scrambled VOIP calls to the media and victim’s business partners with information about the attack. The ransomware gang is likely assuming that warning businesses that their data may have been exposed in an attack on of their partners, will create further pressure for the victim to pay.

REvil Ransomware is also providing a paid service that allows affiliates to perform Layer 3 and Layer 7 DDoS attacks against a company for maximum pressure. A Layer 3 attack is commonly used to take down the company’s Internet connection. In contrast, threat actors would use a Layer 7 attack to take down a publicly accessible application, such as a web server.

It is highly configurable, and it can be customized to behave differently depending on the host. This makes it a highly attractive RaaS client. Some of its features include:

Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453.
Whitelists files, folders and extensions from encryption.
Kills specific processes and services prior to encryption.
Encrypts files on local and network storage.
Customizes the name and body of the ransom note, and the contents of the background image.
Exfiltrates encrypted information on the infected host to remote controllers.
REvil Ransomware uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers.

REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host. If the configuration instructs a sample to execute this exploit, it will allocate executable memory, decrypt the exploit code in the newly allocated region and invoke it.

Protection Against Ransomware

REvil Ransomware and other Ransomware clients are some of the most common and deadly cybersecurity threats out there today. Families and businesses should be aware of these threats, and equip the right tools to tackle them. One of these tools is SaferNet.

New Meris Botnet Breaks Records With 21.8 Million Requests Per Second

Post On: 24 October, 2021 By : Jerry

Meris Botnet, a new distributed denial-of-service (DDoS) virus, emerged over the summer and began a barrage of attacks on internet giant Yandex and has recently peaked its attack speed at 21.8 million requests per second. Meris Botnet gets its power from tens of thousands hacked devices that researchers believe to be networking equipment. It gets its name from Latvian, where Meris means ‘plague’

Last week Russia media covered the attack on Yandex, and described it as being the largest in the history of the Russian internet – also called RuNet. RuNet is the Russian segment of the internet, created to function independently of the worldwide web. Its purpose is to maintain the unified country-wide communication infrastructure running in case of a cyber attack from a foreign adversary. It is actively monitored by Russian authorities.

Details on the attacks were published lately in joint research from Yandex and its DDoS protection partner, Qrator Labs. Information collected by the researchers showed that Meris Botnet has a striking force of 250,000 devices under its control.

“Yandex’ security team members managed to establish a clear view of the botnet’s internal structure. L2TP tunnels are used for internetwork communications. The number of infected devices, according to the botnet internals we’ve seen, reaches 250000” stated researchers at Qrator Labs.

Initial research put the number at 30000, which is the amount Meris Botnet has used in most cases. However, it is believed that the botnet operators are using lower numbers for now as to not parade the full power of their botnet.

Qrator pointed out that compromised hosts in Meris Botnets’ collection are “not your typical IoT blinker connected to WiFi”, but more capable devices that require an Ethernet connection. This speaks volumes about the development behind Meris Botnet – Usually, botnets will go for ‘low-hanging fruit’ when looking for IoT devices to infect.

Meris Botnet was also responsible for generating the largest volume of attack traffic that Cloudflare recorded and mitigated, which peaked at 17.2 million requests per second. This was broken by the botnets later September 5th attack, which as stated reached 21.8 million RPS.

Meris Botnet’s attacks on Yandex began in early august with a hit of 5.2 million RPS and gradually increased:

2021-08-07 – 5.2 million RPS
2021-08-09 – 6.5 million RPS
2021-08-29 – 9.6 million RPS
2021-08-31 – 10.9 million RPS
2021-09-05 – 21.8 million RPS

Meris Botnet Analysis

Note: This analysis was carried out by Qrator Labs.

To deploy an attack, the researchers say that Mēris relies on the SOCKS4 proxy at the compromised device, uses the HTTP pipelining DDoS technique, and port 5678.

As for the compromised devices used, the researchers say that they are related to MikroTik, the Latvian maker of networking equipment for businesses of all sizes.

Most of the attacking devices had open ports 2000 and 5678. The latter points to MikroTik equipment, which uses it for the neighbor discovery feature (MikroTik Neighbor Discovery Protocol).

Qrator Labs found that while MikroTik provides its standard service through the User Datagram Protocol (UDP), compromised devices also have an open Transmission Control Protocol (TCP).

This kind of disguise might be one of the reasons devices got hacked unnoticed by their owners,” Qrator Labs researchers believe.

Distribution of open ports 5678. The darker shows where there are more devices. Source: Qrator Labs

When searching the public internet for open TCP port 5678, more than 328,000 hosts responded. The number is not all MikroTik devices, though, as LinkSys equipment also uses TCP on the same port

Port 2000 is for “Bandwidth test server,” the researchers say. When open, it replies to the incoming connection with a signature that belongs to MikroTik’s RouterOS protocol.

MikroTik has been informed of these findings. The vendor told Russian publication Vedomosti that it is not aware of a new vulnerability to compromise its products.

The network equipment maker also said that many of its devices continue to run old firmware, vulnerable to a massively exploited security issue tracked as CVE-2018-14847 and patched in April 2018.

However, the range of RouterOS versions that were observed in attacks from Meris botnet varies greatly and includes devices running newer firmware versions, such as the current stable one (6.48.4) and its predecessor, 6.48.3.

Protection

Medical-Tech Giant Olympus Infected With BlackMatter Ransomware

Post On: 24 October, 2021 By : Jerry

BlackMatter Ransomware has struck Olympus, a leading medical technology company. Olympus announced last week it was investigating a “potential cybersecurity incident” that impacted some of its EMEA (Europe, Middle East, Africa) IT systems last week. The company employs 31,000 individuals worldwide and has been active for over 100 years, making developments in the medical, life sciences, and industrial equipment industries.

“Olympus is currently investigating a potential cybersecurity incident affecting limited areas of its EMEA (Europe, Middle East, Africa) IT systems on September 8, 2021,” the company said in a statement published Saturday, three days after the attack.

“Upon detection of suspicious activity, we immediately mobilized a specialized response team including forensics experts, and we are currently working with the highest priority to resolve this issue. As part of the investigation, we have suspended data transfers in the affected systems and have informed the relevant external partners.”

Olympus also stated that they’re still working to discover the extent of the damage caused by the BlackMatter Ransomware attack.

Though the company themselves have not confirmed BlackMatter Ransomware was the culprit, ransom notes left on impacted systems point to the gang as the perpitrators.

BlackMatter Ransomware was initially considered to be a newcomer on the scene when it appeared in late July 2021, though it is now confirmed that it is simply a rebrand of Darkside Ransomware.

The Darkside operation shut down after the Colonial Pipeline attack earlier this year as the gang were facing pressure from both international law enforcement and the US government.

BlackMatter Ransomware Analysis

This analysis of Darkside was carried out largely by researchers at Cybereason. It was completed before the gang retired. As BlackMatter Ransomware and DarkSide share the same codebase, the analysis is valid.

Like many other ransomware variants, BlackMatter follows the double extortion trend, which means the threat actors not only encrypt the user’s data, but first exfiltrate the data and threaten to make it public if the ransom demand is not paid. This technique effectively renders the strategy of backing up data as a precaution against a ransomware attack moot.

After gaining an initial foothold in the network, the attackers start to collect information about the environment and the company. If it turns out that the potential target is on the attacker’s list of prohibited organizations to attack (ie: hospitals, hospices, schools, universities, non-profit organizations, or government agencies), they don’t move forward with the attack.

If not on the prohibited list, the attackers continue to carry out the operation. The attackers begins to collect files, credentials and other sensitive information, and exfilitrate it. Following this, the attackers use PowerShell to download the BlackMatter Ransomware binary as “update.exe” using the “DownloadFile” command, abusing Certutil.exe and Bitsadmin.exe in the process.

In addition to downloading the BlackMatter Ransomware binary into the C:\Windows and temporary directories, the attacker also creates a shared folder on the infected machine and uses PowerShell to download a copy of the malware there.

After successfully gaining a foothold on one machine in the environment, the attacker begins to move laterally in the environment, with the main goal of conquering the Domain Controller (DC).

Once the attackers make it to the DC, they start to collect other sensitive information and files, including dumping the SAM hive that stores targets’ passwords

In addition to collecting data from the DC, the attackers use PowerShell to download the BlackMatter binary from the shared folder created on the previously infected host.

When the BlackMatter ransomware first executes on the infected host, it checks the language on the system, using GetSystemDefaultUILanguage() and GetUserDefaultLangID() functions to avoid systems located in the former Soviet Bloc countries from being encrypted.

Darkside Ransomware checking if the installed language is Russian

After successfully gaining a foothold on one machine in the environment, the attacker begins to move laterally in the environment, with the main goal of conquering the Domain Controller (DC).

Once the attackers make it to the DC, they start to collect other sensitive information and files, including dumping the SAM hive that stores targets’ passwords

In addition to collecting data from the DC, the attackers use PowerShell to download the BlackMatter binary from the shared folder created on the previously infected host.

Protection

SOVA Android Banking Trojan Takes Flight With Big Dreams

Post On: 24 October, 2021 By : Jerry

A new Android banking trojan dubbed SOVA (“Owl” in Russian) has emerged and is active development according to researchers at ThreatFabric. Though still in the early stages, SOVA is looking to be extremely sophisticated for Android malware and may pose a serious threat upon release. SOVA seeks to incorporate distributed denial of service (DDoS), man in the middle (MiTM) and ransomware functionality into its arsenal – on top of existing banking overlay, notification manipulation and keylogging services.

Researchers at ThreatFabric note that the hackers ambitions for SOVA are sky-high.

“This malware is still in its infancy [first appearing in August, now only on version 2] and it is undergoing a testing phase…prospecting serious and worrying plans for the near future,” they said in a Friday analysis, noting that the malware’s roadmap is laid out in underground forum posts advertising its availability for testing.

“SOVA is…taking a page out of traditional desktop malware,” they added. “Including DDoS, man in the middle and ransomware to its arsenal could mean incredible damage to end users, in addition to the already very dangerous threat that overlay and keylogging attacks serve.”

Analysis of SOVA showed that the coding and development choices behind the virus are highly sophisticated.

“Regarding the development, SOVA also stands out for being fully developed in Kotlin, a coding language supported by Android and thought by many to be the future of Android development,” according to ThreatFabric. “If the author’s promises on future features are kept, SOVA could potentially be the most complete and advanced Android bot to be fully developed in Kotlin to this day.”

SOVA, like many other malware strains, relies on legitimate software to function. In SOVA’s case, it uses RetroFit for its communication with the command-and-control (C2) server.

“Retrofit is a type-safe REST client for Android, Java and Kotlin developed by Square,” researchers said. “The library provides a powerful framework for authenticating and interacting with APIs and sending network requests with OkHttp.”

SOVA makes use of a banking trojan mainstay – Overlays. However, the malware uses multiple overlays to imitate a number of banking institutes worldwide.

“According to the authors, there are already multiple overlays available for different banking institutions from the U.S. and Spain, but they offer the possibility of creating more in case of necessity from the buyer,” researchers noted. Also, version 2 contains functionality to target users of some Russian banks – drawing ire from other forum users, ThreatFabric reported.

“When it is started for the first time, the malware hides its app icon and abuses the Accessibility Services to obtain all the necessary permissions to operate properly,” researchers explained. Some of those permissions allow it to intercept for SMS messages and notifications for instance, to better hide from the victim – and on the roadmap is also the ability to circumvent two-factor authentication.

One feature that sets SOVA apart from its contemperoarys is its ability to steal session cookies. This allows the virus to piggyback on valid logged-in banking sessions, thus skirting the need to have banking credentials to access victim’s accounts.

Still ahead on the roadmap, SOVA’s authors said that they will soon add “automatic three-stage overlay injections.”

“It is not clear what the three stages imply, but it could mean more advances and realistic process, maybe implying download of additional software to the device,” researchers noted.

ThreatFabric concluded by pointing out that SOVA could become one of the most dangerous threats in the Android ecosystem.

“The second set of features, added in the future developments, are very advanced and would push SOVA into a different realm for Android banking malware,” they said. “If the authors adhere to the roadmap, it will also be able to feature…DDoS capabilities, ransomware and advanced overlay attacks. These features would make SOVA the most feature-rich Android malware on the market and could become the ‘new norm’ for Android banking trojans targeting financial institutions.”

SOVA Analysis

Note: This analysis was carried out by ThreatFabric.

Currently, ThreatFabric identified five samples of SOVA in the wild, with a total of three different malware versions.

The string highlighted, underneath the file’s hash, is the name the file was uploaded to VirusTotal with. The file name is ‘vormastor test crypted.apk’. As mentioned in the introduction, we conclude that this malware family is still in its testing phase and has been for a few weeks. This is confirmed by a post by the author and seller of SOVA, who was already looking for testers at the end of July.

At the beginning of September, this same user published the first post aimed at selling the bot. In the same thread, the seller is being criticized by other members for having Russian banks within the list of targets. From this thread it also seems that the future versions of this Android malware could switch back to Java, to address some compatibility issues with the obfuscation software they are using.

According to the authors, there are already multiple overlays available for different banking institutions from the USA and Spain, but they offer the possibility of creating more in case of necessity from the buyer.

The main objective of SOVA is to gather the victim’s PII.

SOVA tries its best to remain undetected. To achieve this, SOVA abuses the overlay mechanic to trick victims into revealing their passwords, and other important private information. In an overlay attack, users type their credentials in what they think is a legitimate banking app, effectively giving them to a page controlled by the attacker. SOVA also has the possibility to steal session cookies from the device. This feature is not unheard of but is definitely not common on modern Android Trojans.

Like most of the banking trojans, SOVA heavily relies on Accessibility Services. When it is started for the first time, the malware hides its app icon and abuses the Accessibility Services to obtain all the necessary permissions to operate properly.

Functionalities of the bot, as advertised by its authors, include:

Steal Device Data.
Send SMS.
Overlay and Cookie injection.
Overlay and Cookie injection via Push notification.
USSD execution.
Credit Card overlays with validity check.
Hidden interception for SMS.
Hidden interception for Notifications.
Keylogger.
Uninstallation of the app.
Resilience from uninstallation from victims.

The features that SOVA offers are in line with the standard for Android malware that we are used to see in 2021. However, as previously mentioned, the criminals behind this bot are very proactive and have also released a detailed roadmap of the features to be included in the future releases ofSOVA:

Automatic 3 stage overlay injections.
Automatic cookie injections.
Clipboard manipulation.
DDoS
Improved Panel Health.
Ransomware (with overlay for card number).
Man in the Middle (MitM).
Normal Push notifications.
More overlays.
VNC.

The following list includes all the commands that can be send by the C2 to the bot:

Like the large majority of Android banking trojans, SOVA relies on Overlay attacks to steal PII from its victims. If the user is trying to access a banking application included in SOVAs active target list, the malware will be notified with Accessibility Services, and will display a WebView overlay posing as the intended banking application.

In the following graph you can observe the country distribution of the targets:

Another interesting feature of SOVA, which is uncommon in Android malware, is the ability to steal cookies. Cookies are a vital part of web functionality, which allow users to maintain open sessions on their browsers without having to re-input their credentials repeatedly. A malicious actor in possession on a valid session cookie has effectively access to the victim’s logged in web session.

Protection

Acquisition of VPNs by Big Tech Raises Privacy Concerns

Post On: 24 October, 2021 By : Jerry

“If U.S. intelligence experts believe Beijing and Moscow are leveraging Chinese and Russian-made technology to surveil Americans, surely DHS should also be concerned about Americans sending their web browsing data directly to China and Russia.”

These were the words of Senators Marco Rubio (R-FL) and Ron Wyden (D-OR) to Christopher Krebs, Director at the Cybersecurity and Infrastructure Security Agency (CISA) in a bipartisan investigation into the extent to which VPN companies are being used by Russia and China as surveillance tools to spy on Federal employees.

The investigation was not the first of its kind – a similar examination took place in 2019, and DHS issued a ban of Kaspersky products on Federal IT systems.

Both investigations were carried out to protect federal systems, but such findings must be extended to ordinary American citizens also.

The concern that VPN services have been funneling user data to foreign countries via a parent company has been present for a number of years, but the acquisition of ExpressVPN by Kape Technologies PLC has renewed those fears once more.

ExpressVPN has been a leader in the Virtual Private Network sector for several years and has over three million subscribers. The acquisition shed some light on their finances, showing that they generated “revenues of approximately $279.4 million in 2020, up 37% from 2019”. They have championed data privacy since their launch, often appearing in collaboration with other privacy-oriented services like DuckDuckGo.

ExpressVPN went a step further, establishing their HQ in the British Virgin Isles, and establishing their own protocol named Lightway to ensure user privacy.

Kape Technologies bought the company last week for $936 million, which makes it the most expensive acquisition in the history of the VPN industry.

The acquisition marks the fourth time Kape has purchased a VPN. 2017, it acquired Romanian VPN provider CyberGhost VPN, and in October 2018, it acquired the German-based VPN provider ZenMate.

Acquisitions are not cause for concern by themselves, however, Kape’s past certainly casts a shadow over the deal. Up until March 2018, Kape was known as Crossrider. The name change was due to gaining a shady reputation – Crossrider was branded as Adware by Symantec’s Security Center. The program replaced ads with its own in browsers, collected personal data, and connected to the Crossrider domain.

Malwarebytes had a similar outlook warning users that the Crossrider program was involved in browser hijacking, malicious software bundlers, adware, and other monetizing methods.

There are other factors to consider in the Kape/Crossrider story. Its founder and CEO for a number of years was part Unit 8200, an elite Israeli government body similar to the NSA. Its main investor was Teddy Sagi, whose name is included in the Panama Papers.

With details such as these, users of ExpressVPN who subscribed out of privacy concerns have a right to worry.

ExpressVPN is not the first VPN company to be acquired by a larger company with a shady or undesirable background. A study from VPNpro showed that 101 companies belong to just 23 companies, many of which are based in countries with poor privacy regulations.

The study highlighted that nearly 33% of popular VPNs are owned by Chinese companies, or run by Chinese nationals. This means user data is likely open to Chinese authorities, confirming US Senators’ fears of American data falling into Chinese or Russian hands. China is the world leader in online surveillance, which is the very thing VPNs purport
to protect.

Not only are VPN providers in foreign nations obliged to hand over data to Government, it is also possible that they’re selling the information to their respective governments.

VPN users are at risk from these parents companies, risking their data being sold privately to other companies or being handed over to foreign governments. Based on research by VPNPro, we’ll look at some other companies besides Kape that own large slices of the VPN cake.

j2 Global – 13 VPN services

j2 Global, which also owns tech publication PCMag (who coincidentally do VPN reviews) recently acquired StackPath’s VPN products. StackPath states that they’re “an American content delivery network, cloud service, and web application firewall provider.” To branch out, StackPath bought Highwinds in 2017, which included IPVanish, StrongVPN, and Encrypt.me (formerly Cloak).

j2 Global is connected to many more VPNs than its website claims. On top of IPVanish, StrongVPN, and Encrypt.me, it also owns SaferVPN and OverPlay VPN through its subsidiary NetProtect.

The company also owns WLVPN.com, a white-label service that offers VPN infrastructure and strategy services.

With a white-label, VPN providers can buy software development kits (SDKs) from WLVPN to help them develop their VPN applications and features.

NetProtect claims that more than 100 businesses use WLVPN’s infrastructure and tools to power their VPNs, including StrongVPN, OverPlay VPN, Encrypt.me, and VPNhub, Pornhub’s VPN service. j2 Global’s reach should not be understated, and given that they own the largest publication that does VPN reviews it should be cause for concern.

AnchorFree – 10 VPN services

AnchorFree is a veteran on the VPN scene, first appearing in 2008 with HotSpotShield. Though a popular VPN, HotSpotShield was mired in controversy and rumors that they were selling user data.

In August 2017, the Center for Democracy and Technology (CDT) issued an open complaint to the Federal Trade Commission which they state “concerns undisclosed and unclear data sharing and traffic redirection occurring in Hotspot Shield Free VPN that should be considered unfair and deceptive trade practices under Section 5 of the FTC Act.” CDT “partnered with researchers at Carnegie Mellon University to analyze the app and the service and found ‘undisclosed data sharing practices’ with advertising networks.”

Though mostly known for HotSpotShield, AnchorFree has been quietly buying up a number of VPN services.

In February 2015, AnchorFree acquired JustVPN and TouchVPN. JustVPN has just one VPN product: an Android app called “JustVPN – Free Unlimited VPN & Proxy.”

TouchVPN has three unique apps. Two are for Android (Touch VPN, VPN 360), and three are for iOS: VPN 360, Touch VPN, VeePee VPN Proxy.

In November 2016, Betternet Technologies was acquired by AnchorFree. Betternet creates the following mobile apps:

Android:

VPN Free – Betternet Hotspot VPN & Private Browser
VPN Proxy by HexaTech
VPN in Touch (developer listed as just “Betternet”)

iOS:

Best VPN Proxy Betternet
HexaTech Unlimited VPN
VPN in Touch
VPN Pro | Lifetime Proxy & Best VPN by Betternet

Gaditek – 7 VPN services

Gaditek is a Pakistan-based company that owns PureVPN, Ivacy, and Unblock – a newer VPN and proxy product. Pakistan’s own privacy laws are not particularly rigid, and the country has often come under fire from international NGOs. Freedom House’s annual internet freedom report has repeatedly given Pakistan a rating of “not free.”

Pakistan practices heavy online censorship. The government blocks residents from accessing websites and social media platforms that express dissenting political opinions. Authorities also frequently disable mobile internet access during large protests or other politically sensitive events.

There are several cases of people being sentenced to death for their social media activity. Some reports suggest that Pakistan has begun targeting human rights defenders with invasive cyberattacks.

Pakistani law also makes it extremely easy for authorities to obtain a warrant to access citizens’ private data for almost any reason. This begs the question, how much control does the Pakistan government have over Gaditek?

The employees of Gaditek/PureVPN have also been connected to the following VPN review sites:

vpnranks.com
bestvpnservice.com
kodivpn.co
bestvpn.co (previously bestvpnprovider.com)
usavpn.com

Some employees of PureVPN and Gaditek also worked for another VPN provider called OneVPN, which is owned by Unravel Technologies.

Unravel is supposed to be based in Hong Kong, but like PureVPN, its base is actually in Karachi, Pakistan. Muhammad Fahad’s job profile shows him working at first Gaditek then Unravel, both in Karachi:

PureVPN, IvacyVPN, and vpnranks.com all share the same registration address in Singapore. The next company on this list – Innovative Connecting – also has the same address.

Innovative Connecting – 10 VPN services

Innovative Connecting is a young Singapore-based tech company that specializes in mobile app development. This Android developer directly makes TurboVPN, VPN Master, VPN Proxy Master Pro, and VPN Proxy Master Lite. It also develops the iOS app VPN Sofast – Mymobilesecure.

Innovative Connecting has been connected with Lemon Clove as well (in addition to a third company, ALL Connected Co. Ltd). Lemon Clove makes the VPN apps Snap VPN and VPN Robot.

Lemon Clove and Innovative Connecting both have the same secretary and key addresses. Additionally, the company’s LinkedIn page says that its product development team is actually based in China. Director Danian “Danny” Chen is a Chinese national.

When researchers studied the APK files for the three companies, they found the API calls going to the same domains

While it is clear Innovative are trying to hide their reach, they are behind many more VPNs than they claim to be.

SuperSoftTech – 3 VPN services

The company developers 3 apps; SuperVPN, VPN Payment Tool, and LinkVPN. While the apps are officially owned by the SuperSoftTech company based in Singapore, it actually belongs to the independent app publisher Jinrong Zheng – most likely a Chinese national based in Beijing.

The contact email address on the Play store ([email protected]) links to a Chinese address in Beijing. Jinrong Zheng has released several apps (mostly games) that almost all start with the prefix “Super.”

SuperVPN has been ranked the #3 most malware-rigged VPN app in a 2016 Australian research by Csiro:

Other Companies That Own Several VPNs

Hotspot VPN (5 apps): Director Zhu Jianpeng has a residential address in Heibei Province in China
Hi Security (3 VPN apps): the VPN apps are part of Shenzhen HAWK Internet, a subsidiary of the Chinese major company TCL Corporation
Newbreed Network Pte.Ltd (6 apps): While it has a Singapore address, the websites for its VPN apps SGreen VPN and NodeVPN are completely in Chinese, while NodeVPN’s site lists the People’s Republic of China as its location.

A Risk-Free VPN and the Future of the Industry

It is clear that the VPN industry, initially thought to be a bastion of privacy and security, has become controlled by mendacious parent companies, holding companies, and megacorporations that are willing to sell out the average user to governments or advertisers.

In an age where living without a VPN leaves you and your data entirely exposed, it is nothing short of tragic that users wishing to escape into the safe harbor of a trusted VPN have their fears turned against them.

There are always independent VPN services fighting the privacy fight in earnest, without turning on users and seeing them as the product to sell.

When considering a VPN service, consumers now must be well-informed or face the risks associated with choosing an untrustworthy provider.

Here are some factors those who are searching for a VPN should keep in mind:

Independence; is the service owned by another company who themselves own a number of other VPN services?
Data Limits
Speed and throttling
Price; the majority of ‘Free’ VPNs are expected to sell your data
Security
Company headquarters – Is the company based in a country with modern privacy laws?
Privacy; what kind of logs are kept?
Customer support

At SaferNet, we offer a competitive VPN for individuals, families, and businesses that ticks all these boxes and more.

A Look At VPNs Covertly Operating From Within Chinese Boarders

Post On: 24 October, 2021 By : Jerry

VPNs (Virtual Private Networks) are a significant factor in ensuring a safe connection and privacy when using the internet. In an age where consumer privacy is not given much priority, the number of VPNs available and VPN users signing up for them has exploded. The competition for providers is fierce, and a handful of companies control the majority of the market.

The underlying technology that makes up a VPN is sophisticated, involving information encryption which is fed through the VPN companies’ servers, and sent to the wider internet. Thus, there is a degree of trust required between the VPN user and the company they decide to sign up with.

Of course, there is no VPN company in operation out there that will admit that they’re untrustworthy, or that they sell data, or that they have a checkered history when it comes to privacy. In fact, many VPN providers will go to great lengths to conceal that they’re owned by other companies which may have come under scrutiny in the past.

VPN companies will go to even greater lengths to conceal the fact that they may be owned by a company in a different country – Specifically one in China. In a recent report by VPNPro, it was revealed that a third of major VPN providers are either owned by Chinese companies directly or are owned by proxy, via shell companies and Chinese students in C-level positions.

In short, many VPN providers are not being transparent with their userbase.

The interference of the Chinese Communist Party in business affairs is no secret, with business operating in China as a sort of State-controlled quasi-capitalism system. Not only does the CCP have absolute reach into the business dealings of a company operating from within their borders, a VPN owned by a Chinese company means that the Chinese government can legally demand users’ data.

This has not gone unnoticed by the government of the United States. A recent bipartisan investigation was taken up by Senators Marco Rubio (R-FL) and Ron Wyden (D-OR) into the extent to which VPN companies are being used by Russia and China as surveillance tools to spy on Federal employees. In the report, the Senators said, “If U.S. intelligence experts believe Beijing and Moscow are leveraging Chinese and Russian-made technology to surveil Americans, surely DHS should also be concerned about Americans sending their web browsing data directly to China and Russia.”

The situation is grave, and it’s getting much worse as more popular VPN providers are being bought up Chinese firms. In addition, VPNs with Chinese developers have begun to flood the US market. These VPNs provide a direct line of information about American citizens straight back to Chinese authorities.

The VPN market, once a stronghold of privacy, has become a data-driven arms race as corporations use providers as funnels for information. In this post, we’ll look at some of the largest VPN services coming out of China, which should be avoided at all costs.

Innovative Connecting

Innovating Connecting (IC) is a significant player in the VPN market, owning a total of ten different VPNs. The company is also known as ALL Connected (AC), and on their website they claim to be based out of Singapore. However, digging into the company via LinkedIn reveals that the development unit is based in China. The director at the company, Danian “Danny” Chen, is a Chinese national.

Looking deeper into the code of several VPNs and company addresses, one can learn that IC and AC share the same address and similar code as Lemon Clove (LC), yet another VPN company that develops VPN Robot and SnapVPN. Lastly, LC themselves go by another name, Autumn Breeze (AB). AB develops Hot VPN and Unlimited Free VPN Monster.

Of the ten, here are the 5 most popular, with reviews from Techshielder:

Turbo VPN
Despite its mobile applications having numerous downloads, this is not a safe VPN to use. Turbo VPN is an example of fame not equating quality. Stay away from this VPN if you value your privacy, as it will release your information if requested by the government. Despite its no-log policy, it collects data regarding where you’re connecting from, where you’re connecting to, the size of data, and other analytics data. It is also full of unwanted ads, risky permissions, malware, and DNS leaks. In summary, using Turbo VPN is a risk that you might not be willing to take.

VPN Proxy Master
Here is another famous free VPN service provider. The problem with most free VPNs is that since they are not making any money from subscriptions to their service, they look for alternative ways to make do. It has advertising partners like Facebook, UnityAd, Vungle, and AdMob. VPN Proxy Master has a nosy logging policy and lacks extensive security features. It is better to find an excellent alternative VPN if you are not a fan of these features.

Solo VPN
Minor security features, nosy logging policy, no torrenting, lack of popular streaming support, and aggressive ads are features of this mobile VPN application. Although it uses strong encryption to protect your data, it still does not guarantee your privacy.

Unlimited Free VPN Monster
This Android-only VPN service provider’s free version will expose you to aggressive ads. It lacks essential security features and doesn’t seem to offer any information about the type of encryption it uses. Although it is clear about the data it collects, it has not been transparent about its owners and location. The lack of transparency is enough reason to avoid Unlimited Free VPN Monster.

IC is shrouded in mystery, has awful business practices, and isn’t being transparent with users. Despite this, their VPNs are popular. It is advisable to stay away from their applications.

SuperSoftTech

Similar to Innovative Connecting, SuperSoftTech operates officially from Singapore. The company however belongs to Jinrong Zheng, a Chinese citizen living in Beijing. Applications created by Zheng include SuperVPN, VPN Payment Tool, and LinkVPN.

SuperVPN
SuperVPN is one of the most popular VPNs worldwide, with over a hundred million downloads on Google Play Store. It has the same privacy policy as LinkVPN, which is from the same developer. Its privacy policy gives hints that it might oblige if a superior authority requests your data because it scans IPs against a blacklist.

SuperVPN also stores data in the US and UK according to its privacy policy; however, it is unclear what data this VPN collects and stores. Since users don’t require an account to use SuperVPN, it is confusing why there is a need to store any user data. Although this application has the necessary security protocols to keep you secure, it requests unnecessary permissions from your device. Accepting some of these permissions can leave your data vulnerable.

Despite its popularity, SuperVPN is mired in controversy and has been accused of popping unwanted ads and actually infecting the user with malware. SuperVPN has been ranked the #3 most malware-rigged VPN app in a 2016 Australian research by Csiro:

Other Chinese Companies That Own Or Develop VPNs

Owning over a third of the market, there are a number of other Chinese firms that operate or develop VPNs. Here are some of them:

Newbreed Network
Newbreed Network has about six VPN applications to its name. It claims to operate in Singapore, but the websites of a couple of its VPN applications are in Chinese. VPN Green, SGreen, MasterVPN, NodeVPN, TXVPN, and AirGO Fast are applications with links to Newbreed Network.

Hotspot VPN
The director of Hotspot VPN is Chinese and is resident in China. VPN applications include Free VPN, Hotspot VPN, Secure VPN, and Easy VPN.

Hi Security
Hi Security holds three VPNs: Hi VPN Free, Hi VPN Pro, and Net Master. These applications are part of Shenzhen HAWK Internet, a company under TCL Corporation, a notable Chinese company.

LEILEI
LEILEI owns Yunfan VPN and Bit VPN.

A Risk-Free VPN and the Future of the Industry

There are always independent VPN services fighting the privacy fight in earnest, without turning on users and seeing them as the product to sell.

When considering a VPN service, consumers now must be well-informed or face the risks associated with choosing an untrustworthy provider.

Here are some factors those who are searching for a VPN should keep in mind:

Independence; is the service owned by another company who themselves own a number of other VPN services?
Data Limits
Speed and throttling
Price; the majority of ‘Free’ VPNs are expected to sell your data
Security
Company headquarters – Is the company based in a country with modern privacy laws?
Privacy; what kind of logs are kept?
Customer support

At SaferNet, we offer a competitive VPN for individuals, families, and businesses that ticks all these boxes and more.

VPNs based in Pakistan

Post On: 24 October, 2021 By : Jerry

Recently, SaferNet has reported on the fact that many VPN companies go to great lengths to conceal who truly owns them. Aside from megacorporations playing a part, one of the most notable owners is China, owning a third of all major VPNs through various parent companies. However, another big player in this field is Pakistan, and a company named Gaditek.

This is yet another example of VPN providers not being transparent with their userbase.

Human rights and internet censorship in Pakistan are appalling. Freedom House’s annual internet freedom report has repeatedly given Pakistan a rating of “not free.” due to its actions against citizens and journalists. The Pakistan government practices and the government blocks citizens from accessing websites and social media platforms that express dissenting political opinions.

During large protests and politically sensitive events, authorities often disable mobile internet around the area the events take place in.

Worst of all, there are several cases of people being sentenced to death for their social media activity. Some reports suggest that Pakistan has begun targeting human rights defenders with invasive cyberattacks. The government will often state these are issues of ‘national security’, yet these decisions receive a lot of international criticism.

Pakistani laws and the VPN ethos do not mix. The government enforces strict data retention laws and requires ISPs to keep communication logs for a minimum of one year, or longer if requested by the government. It is also extremely easy for authorities to obtain a warrant to access citizens’ private data for almost any reason. This means that a VPN offers virtually no protection from the Pakistani government.

Gaditek concealing VPN Services

Note: The investigation into Gaditek was initially reported on by VPNPro

Gaditek has a global reach, with 7 VPNs that are popular in Pakistan but also worldwide. While they may promise their users in Pakistan privacy, this is impossible within the laws of the country; something Gaditek isn’t upfront about. From their headquarters in Karachi, Gaditek has deployed several VPNs, the most popular being PureVPN, Ivacy, and unblock. They refer to themselves on their website as “a human-centric New Age company.”

As well as being at the behest of the Pakistani government, Gaditek employs a number of shady marketing practices.

The employees of Gaditek/PureVPN have been connected to the following VPN review sites:

vpnranks.com
bestvpnservice.com
kodivpn.co
bestvpn.co (previously bestvpnprovider.com)
usavpn.com

This is a profile from Humayoun Khan, who worked at Gaditek from 2014-2015 and wrote “unbiased VPN reviews” for vpnranks.com, netflixdown.com, and bestvpnprovider.com:

Additionally, Aazim Akhtar is listed as the Senior Editor for vpnranks.com, but on Zoominfo.com, he’s listed as working at Gaditek as their Team Lead for Content Production:

Vpnranks is one of the most popular VPN ranking websites in the world, with 2.5 million monthly visitors. It is now believed that the website is a front for Gaditek to push their product.

Furthermore, an investigation by VPNPro showed that some employees of PureVPN and Gaditek also worked for another VPN provider called OneVPN, which is owned by Unravel Technologies.

Then there’s Ashad Zaid’s LinkedIn profile that shows he only worked at Gaditek from 2015-2016, but not Unravel Technologies or OneVPN, but still lists OneVPN (along with Gaditek products PureVPN and Ivacy) as some of the projects he’s worked on:

By this, it would seem that Gaditek also owns OneVPN, but is not reported by them. While the Hong Kong address for Unravel suggests a Chinese connection, there is greater evidence else to show an even stronger connection.

PureVPN, IvacyVPN, and vpnranks.com all share the same registration address in Singapore. Yesterday, SaferNet reported on VPNs secretly operating from China. One of the largest companies that do this is name Innovative Connecting (IC).

IC themselves are a whole other story and own several companies they haven’t been transparent about. IC’s registered address is the same as PureVPN, IvacyVPN, and vpnranks.com.

This suggests that there is an incredibly strong link between Gaditek and IC, with the latter possibly being a parent company to the former. Either way, it’s clear that neither company is being quite honest, and that is the last thing a VPN user wants from a provider

A Risk-Free VPN and the Future of the Industry

There are always independent VPN services fighting the privacy fight in earnest, without turning on users and seeing them as the product to sell.

When considering a VPN service, consumers now must be well-informed or face the risks associated with choosing an untrustworthy provider.

Here are some factors those who are searching for a VPN should keep in mind:

Independence; is the service owned by another company who themselves own a number of other VPN services?
Data Limits
Speed and throttling
Price; the majority of ‘Free’ VPNs are expected to sell your data
Security
Company headquarters – Is the company based in a country with modern privacy laws?
Privacy; what kind of logs are kept?
Customer support

At SaferNet, we offer a competitive VPN for individuals, families, and businesses that ticks all these boxes and more.

Top 5 Secure VPNs That Are Focused on Privacy

Post On: 24 October, 2021 By : Jerry

This week, SaferNet has looked at the corruption within the VPN industry. Though the core ethos of the mark focuses on the privacy of its users, we have learned that this is rarely the case. Instead, many VPN providers are owned by data-greedy corporations who sell their users out or even worse are owned by companies based within countries with shakey privacy laws. This often means that such companies are at the mercy of their governments, and user data may freely be passed around with the customer’s knowledge or permission.

It can be easy to lose heart in the industry. In one sense, you are completely vulnerable without a VPN. But seemingly signing up for a VPN can leave you in a much worse position. Despite how bleak the outlook is, there are still several VPN providers fighting the good fight and putting user privacy as their number one priority.

When considering a VPN service, consumers now must be well-informed or face the risks associated with choosing an untrustworthy provider.

Here are some factors those who are searching for a VPN should keep in mind:

Independence; is the service owned by another company who themselves own a number of other VPN services?
Data Limits
Speed and throttling
Price; the majority of ‘Free’ VPNs are expected to sell your data
Security
Company headquarters – Is the company based in a country with modern privacy laws?
Privacy; what kind of logs are kept?

In this post, we’ll look at the top 5 VPNs that put emphasis on privacy and aren’t aiming to sell out their user base. Many of the reviews found here can be seen in greater detail on VPNPro.

VpyrVPN

VyprVPN is one of the best overall VPNs on the market. It offers great privacy and security without sacrificing speed. Implementing WireGuard protocol means that we should see this service among the fastest very soon. This also means that you’re getting great P2P protection without sacrificing speed.

VyprVPN is the best for those living under repressive regimes, such as Russia or North Korea. Even the infamous Great Firewall of China is no match to this VPN.

This VPN has user-friendly apps for all popular platforms, as well as some less popular ones. It will help you get past geo-blocking and watch multiple streaming platforms, Netflix included.

VyprVPN is based in Switzerland, a country known for its strong privacy laws. As such, there has never been any need for the VPN provider to retain logs of user data. However, until late in 2018, VyprVPN company policy was to record some identifying metadata including “the user’s source IP address, the VyprVPN IP address used by the user, connection start and stop time and total number of bytes used.”

Although IP addresses aren’t typically considered Personally Identifiable Information (PII), they can and have been used to identify individuals through their Internet Service Provider (ISP). As such, we try to avoid recommending providers that retain such logs.

Thankfully, VpyrVPN overhauled its policy in 2018 and now keeps no logs whatsoever. The company even subjected itself to an independent audit to prove that no logs are maintained.

ProtonVPN

ProtonVPN is a highly regarded VPN brand from the same CERN scientists who gave us ProtonMail. It has received widespread acclaim for its content protection measures and privacy policy.

ProtonVPN has set out to offer the world a VPN that is secure, not funded through malicious means, and not limited in terms of bandwidth or amount of data transferred.

ProtonVPN is very committed to robust online security and privacy. Security-wise, it’s incredibly safe and is a surefire choice for protecting your digital assets. From hiding your IP address and ensuring your anonymity online, to torrenting safely and avoiding online censorship, this VPN service is pretty much as good as it gets.

ProtonVPN is suitable for security-first users who are willing to wait when this service grows their server and location numbers. It is a hugely ambitious project, lead by the CERN employees, and already the best choice for those who want a free VPN.

SurfShark VPN

Since its launch in 2018, Surfshark has earned the consumer’s trust and became one of the top overall VPNs. This wasn’t just about excellent speed or top-notch security and privacy. The biggest argument for Surfshark VPN was getting all that for a low price.

Operating from the British Virgin Islands, this provider has set a strict standard upon itself. It has a no-logs policy and stays away from the Five Eyes surveillance alliance. Additionally, Surfshark uses military-grade encryption and the latest tunneling protocols to protect its users.

With Surfshark VPN, you’ll be able to torrent safely and watch multiple streaming platforms. There more than 3200+ servers in 65+ countries, so if one won’t unblock Netflix, the other will.

NordVPN

With such a great reputation behind it, Nord has become almost synonymous with the name VPN, and it certainly is a contender for the #1 spot.

NordVPN server list is one of the best in the industry. It allows them to provide truly global coverage and reliable connections all over the world. If you don’t have a particular location in mind, this service can automatically select the best server for you based on their loads.

Many VPN services claim to provide complete anonymity on the internet, but only a few can back it up in features and evidence. NordVPN is one of the few, having these security and privacy features:

Military-grade encryption
Latest tunneling protocols
Minimal logging

In October 2019, it came to light that an attacker remotely accessed one of NordVPN’s servers. NordVPN says there is no evidence that the attacker obtained anything significant. We discuss the attack, and its consequences, in much greater detail in a feature article about the breach. The company has since invested significant time and capital into hardening its systems and practices, including the moves to its own server clusters and diskless servers.

SaferNet

SaferNet was established to give VPN users something they didn’t have previously – Choice. It is engineered to allow users set a tailor-made online experience, allowing them to decide what what should and shouldn’t be allowed to access their devices.

Using the same robust encryption and tunneling protocols found in similar VPNs such as NordVPN, as well as a machine-learning driven approach to cybersecurity, SaferNet is one of the few VPNs on the market that can supplement and enchance traditional security products such as Windows Defender.

SaferNet has a unique approach to logging. Because the VPN can be used to monitor family members or an entire office, account administrators can access logs for all devices under their SaferNet account. However, these logs are entirely after a treshhold of entires or when a number of days has passed. In this sense, SaferNet is the only VPN that lets its customers use logs to their benefit before deleting them.