_:n653645f094f24b63a3f6fb64978856c3xb0
<http://schema.org/articleBody>
"&lt;p&gt;In 2018, we tested 3 popular VPNs: &lt;strong&gt;Hotspot Shield, PureVPN, and Zenmate with accredited researchers to find if the VPNs could leak data&lt;/strong&gt;.&lt;/p&gt;\n&lt;p&gt;While we hoped to find zero leaks, we regretfully found that&lt;strong&gt; all of them leak sensitive data&lt;/strong&gt;.&lt;/p&gt;\n&lt;p&gt;On the positive side, after we contacted the VPN vendors, we saw that two&lt;strong&gt; were fast to respond and release a patch within days&lt;/strong&gt;.&lt;/p&gt;\n&lt;h2  class=&quot;js-tocItem&quot;&gt;&lt;span id=&quot;Heres-a-is-a-summary-of-our-findings&quot;&gt;&lt;/span&gt;&lt;strong&gt;Here’s a is a summary of our findings&lt;/strong&gt;&lt;/h2&gt;\n&lt;ul&gt;\n&lt;li&gt;&lt;a\n                        onmousedown=&quot;clickedLinkInternal(&#039;Article ? - ShortCode Review Link&#039;,&#039;Hotspot Shield&#039;, event);&quot;                     target=&quot;_blank&quot; class=&quot;shortcode_review_link_1274&quot;                     href=&quot;https://www.vpnmentor.com/reviews/hotspot-shield/&quot; &gt;Hotspot Shield&lt;/a&gt;, &lt;a\n                        onmousedown=&quot;clickedLinkInternal(&#039;Article ? - ShortCode Review Link&#039;,&#039;PureVPN&#039;, event);&quot;                     target=&quot;_blank&quot; class=&quot;shortcode_review_link_470&quot;                     href=&quot;https://www.vpnmentor.com/reviews/purevpn/&quot; &gt;PureVPN&lt;/a&gt;, and&lt;span style=&quot;font-size: 16px;&quot;&gt; &lt;a\n                        onmousedown=&quot;clickedLinkInternal(&#039;Article ? - ShortCode Review Link&#039;,&#039;Zenmate VPN&#039;, event);&quot;                     target=&quot;_blank&quot; class=&quot;shortcode_review_link_43666&quot;                     href=&quot;https://www.vpnmentor.com/reviews/zenmate-vpn/&quot; &gt;Zenmate VPN&lt;/a&gt; all suffer from IP leaks.&lt;br /&gt;\n&lt;/span&gt;&lt;/li&gt;\n&lt;li&gt;The leaks allow governments, hostile organizations, or individuals to identify the actual IP address of a user, even with the use of the VPNs.&lt;/li&gt;\n&lt;li&gt;&lt;strong&gt;Zenmate’s leak was somewhat minor compared to the two other VPNs&lt;/strong&gt;.&lt;/li&gt;\n&lt;li&gt;We believe that most other VPNs suffer from similar issues, so &lt;strong&gt;the fast response of Hotspot Shield is something we think is worth commending&lt;/strong&gt;. We felt that they worked with our research team in a fast and serious manner and that they care for their users. They took our research as help for improvement rather than criticism.&lt;/li&gt;\n&lt;li&gt;Since it took longer for ZenMate and PureVPN to respond to us, &lt;strong&gt;we are only sharing information about the vulnerabilities that were found and patched in HotSpot Shield.&lt;/strong&gt; We advise users of PureVPN and Zenmate to be wary of the leaks they may face and check with their VPN providers for an immediate fix.&lt;/li&gt;\n&lt;/ul&gt;\n&lt;h2  class=&quot;js-tocItem&quot;&gt;&lt;span id=&quot;The-research-team&quot;&gt;&lt;/span&gt;&lt;strong&gt;The research team&lt;/strong&gt;&lt;/h2&gt;\n&lt;p&gt;&lt;strong&gt;VpnMentor hired a team of three external ethical hackers to find vulnerabilities in three random popular VPNs.&lt;/strong&gt;&lt;/p&gt;\n&lt;p&gt;While one hacker wants to keep his identity private, the other two are known as File Descriptor and Paulos Yibelo.&lt;/p&gt;\n&lt;p&gt;&lt;strong&gt;&lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-552662372&quot; href=&quot;https://twitter.com/filedescriptor&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener noreferrer&quot;&gt;File Descriptor&lt;/a&gt;&lt;/strong&gt; is a reputable, ethical hacker working for &lt;strong&gt;Cure53&lt;/strong&gt;, the company hired by TunnelBear to identify and fix issues with their VPN applications, and one of the leading companies in security research.&lt;/p&gt;\n&lt;p&gt;&lt;strong&gt;&lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-2103656052&quot; href=&quot;https://twitter.com/PaulosYibelo&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener noreferrer&quot;&gt;Paulos Yibelo&lt;/a&gt;&lt;/strong&gt;, who also managed the team, is a reputable application security researcher. &lt;strong&gt;He has found vulnerabilities in popular VPNs and published them in the past&lt;/strong&gt;. His work was mentioned in ZDNet, SlashDot, and other media sources.&lt;/p&gt;\n&lt;p&gt;*As part of the agreement with our research team, &lt;strong&gt;vpnMentor cannot directly influence the research team nor the conducted research&lt;/strong&gt;.&lt;/p&gt;\n&lt;h2  class=&quot;js-tocItem&quot;&gt;&lt;span id=&quot;Hotspot-Shields-Vulnerabilities&quot;&gt;&lt;/span&gt;&lt;strong&gt;Hotspot Shield’s Vulnerabilities&lt;/strong&gt;&lt;/h2&gt;\n&lt;p&gt;These are the technical details of Hotspot Shield’s vulnerabilities, which have all been fixed by the company:&lt;/p&gt;\n&lt;p&gt;All the issues are related to PAC scripts and were found in the Chrome plug-in. &lt;strong&gt;The mobile and desktop apps were not affected by these vulnerabilities&lt;/strong&gt;.&lt;/p&gt;\n&lt;h3  &gt;1. CVE-2018-7879: Hijack all traffic&lt;/h3&gt;\n&lt;p&gt;We observed the following PAC script used in Hotspot Shield Chome extension:&lt;/p&gt;\n&lt;div class=&quot;vpn-highlight&quot; style=&quot;font-family: monospace;&quot;&gt;function FindProxyForURL(url, host) {&lt;br /&gt;\nif(url.indexOf(‘act=afProxyServerPing’) != -1) {&lt;br /&gt;\nlet parsed = url.match(/act=afProxyServerPing&amp;server=([^&amp;]+)/);&lt;br /&gt;\nif(parsed &amp;&amp; parsed[1]) return ‘https ‘+parsed[1]+’:443; DIRECT;’;&lt;br /&gt;\n}&lt;/div&gt;\n&lt;p&gt;It detects if the current URL has the query parameter act=afProxyServerPing, and if it does, it routes all traffic to the proxy hostname provided by the server parameter.&lt;/p&gt;\n&lt;div id=&quot;attachment_99433&quot; style=&quot;width: 785px&quot; class=&quot;wp-caption aligncenter&quot;&gt;&lt;span class=&quot;img-lazy-wrap&quot; style=&quot;max-width: 785px; margin: 0 auto;&quot;&gt;&lt;span style=&quot;float: left; position: relative; display: block; padding-top: 59.75%;&quot;&gt;&lt;/span&gt;&lt;img aria-describedby=&quot;caption-attachment-99433&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99433&quot; data-with-lazy-wrap data-src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack.png&quot; alt=&quot;Hostpot Sheild Proxy Hijack&quot; width=&quot;785&quot; height=&quot;469&quot;   /&gt;&lt;/span&gt;&lt;noscript&gt;&lt;img aria-describedby=&quot;caption-attachment-99433&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99433&quot; src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack.png&quot; alt=&quot;Hostpot Sheild Proxy Hijack&quot; width=&quot;785&quot; height=&quot;469&quot; srcset=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack.png 1162w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack-300x179.png 300w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack-768x459.png 768w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack-1024x612.png 1024w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack-87x52.png 87w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack-150x90.png 150w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_proxy_hijack-500x299.png 500w&quot; sizes=&quot;(max-width: 785px) 100vw, 785px&quot; /&gt;&lt;/noscript&gt;&lt;p id=&quot;caption-attachment-99433&quot; class=&quot;wp-caption-text&quot;&gt;This is a result of the proxy hijack.&lt;/p&gt;&lt;/div&gt;\n&lt;p&gt;While we believe this is for internal use, &lt;strong&gt;it fails to validate what host is making this “call”&lt;/strong&gt;. Therefore any URL with the aforementioned parameters will have the traffic routed to the specified proxy.&lt;/p&gt;\n&lt;p&gt;The problem with this is that &lt;strong&gt;a malicious adversary could simply ask a victim to visit a link with those parameters&lt;/strong&gt;, and &lt;strong&gt;all traffic will go to an attacker’s proxy server&lt;/strong&gt;. It would be worse if the connection is on HTTP.&lt;/p&gt;\n&lt;h3  &gt;2. CVE-2018-7878 DNS leak&lt;/h3&gt;\n&lt;p&gt;We observed the following PAC script:&lt;/p&gt;\n&lt;div class=&quot;vpn-highlight&quot; style=&quot;font-family: monospace;&quot;&gt;let ip = dnsResolve(host);&lt;/div&gt;\n&lt;p&gt;This means that dnsResolve will make a DNS request via the system DNS. &lt;strong&gt;This is essentially leaking DNS&lt;/strong&gt;, as the proxy is only assigned after all those conditions.&lt;/p&gt;\n&lt;p&gt;How do we prove it?&lt;/p&gt;\n&lt;p&gt;A simple check in https://www.dnsleaktest.com/ reveals your DNS server. This example shows the leak we found with HotSpot Shield.&lt;/p&gt;\n&lt;div id=&quot;attachment_99434&quot; style=&quot;width: 910px&quot; class=&quot;wp-caption aligncenter&quot;&gt;&lt;span class=&quot;img-lazy-wrap&quot; style=&quot;max-width: 910px; margin: 0 auto;&quot;&gt;&lt;span style=&quot;float: left; position: relative; display: block; padding-top: 59.78%;&quot;&gt;&lt;/span&gt;&lt;img aria-describedby=&quot;caption-attachment-99434&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99434 &quot; data-with-lazy-wrap data-src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak.png&quot; alt=&quot;&quot; width=&quot;910&quot; height=&quot;544&quot;   /&gt;&lt;/span&gt;&lt;noscript&gt;&lt;img aria-describedby=&quot;caption-attachment-99434&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99434 &quot; src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak.png&quot; alt=&quot;&quot; width=&quot;910&quot; height=&quot;544&quot; srcset=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak.png 1162w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak-300x179.png 300w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak-768x459.png 768w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak-1024x612.png 1024w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak-87x52.png 87w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak-150x90.png 150w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_dns_leak-500x299.png 500w&quot; sizes=&quot;(max-width: 910px) 100vw, 910px&quot; /&gt;&lt;/noscript&gt;&lt;p id=&quot;caption-attachment-99434&quot; class=&quot;wp-caption-text&quot;&gt;Our leak that we found with HotSpot Shield on the Chrome extension&lt;/p&gt;&lt;/div&gt;\n&lt;p&gt;Notice, any site can read the DNS server the user is using (hence, leaking your country and other vital information). This site is just a tool to help you check that.&lt;/p&gt;\n&lt;h3  &gt;3. CVE-2018-7880 IP leak&lt;/h3&gt;\n&lt;p&gt;We observed the following PAC script:&lt;/p&gt;\n&lt;div class=&quot;vpn-highlight&quot; style=&quot;word-break: break-all; font-family: monospace;&quot;&gt;let whiteList = /localhost|accounts.google|google-analytics.com|chrome-signin|freegeoip.net|event.shelljacket|chrome.google|box.anchorfree|googleapis|127.0.0.1|hsselite|firebaseio|amazonaws.com|shelljacket.us|coloredsand.us|ratehike.us|pixel.quantserve.com|googleusercontent.com|easylist-downloads.adblockplus.org|hotspotshield|get.betternet.co|betternet.co|support.hotspotshield.com|geo.mydati.com|control.kochava.com/;if(isPlainHostName(host) || shExpMatch(host, ‘*.local’) || isInNet(ip, ‘10.0.0.0’, ‘255.0.0.0’) || isInNet(ip, ‘172.16.0.0’, ‘255.240.0.0’) || isInNet(ip, ‘192.168.0.0’, ‘255.255.0.0’) || isInNet(ip, ‘173.37.0.0’, ‘255.255.0.0’) || isInNet(ip, ‘127.0.0.0’, ‘255.255.255.0’) || !url.match(/^https?/) || whiteList.test(host) || url.indexOf(‘type=a1fproxyspeedtest’) != -1) return ‘DIRECT’;&lt;/div&gt;\n&lt;p&gt;What we found is that &lt;strong&gt;the whitelist for DIRECT connection is just too loose&lt;/strong&gt;.&lt;/p&gt;\n&lt;p&gt;Here are two examples we found:&lt;/p&gt;\n&lt;ol&gt;\n&lt;li&gt;Any domain with localhost will bypass the proxy, e.g. localhost.foo.bar.com&lt;/li&gt;\n&lt;li&gt;Any URL with type=a1fproxyspeedtest will bypass the proxy&lt;/li&gt;\n&lt;/ol&gt;\n&lt;p&gt;How do we prove it?&lt;/p&gt;\n&lt;p&gt;We went to &lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-803892160&quot; href=&quot;https://www.vpnmentor.com/tools/ipinfo/?type=a1fproxyspeedtest&quot; target=&quot;_blank&quot; &gt;this site&lt;/a&gt; with the unpatched version of Hotspot Shield, and our actual IP was leaked.&lt;/p&gt;\n&lt;div id=&quot;attachment_99435&quot; style=&quot;width: 847px&quot; class=&quot;wp-caption aligncenter&quot;&gt;&lt;span class=&quot;img-lazy-wrap&quot; style=&quot;max-width: 847px; margin: 0 auto;&quot;&gt;&lt;span style=&quot;float: left; position: relative; display: block; padding-top: 59.74%;&quot;&gt;&lt;/span&gt;&lt;img aria-describedby=&quot;caption-attachment-99435&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99435&quot; data-with-lazy-wrap data-src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak.png&quot; alt=&quot;Hotspot Shield IP leak&quot; width=&quot;847&quot; height=&quot;506&quot;   /&gt;&lt;/span&gt;&lt;noscript&gt;&lt;img aria-describedby=&quot;caption-attachment-99435&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99435&quot; src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak.png&quot; alt=&quot;Hotspot Shield IP leak&quot; width=&quot;847&quot; height=&quot;506&quot; srcset=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak.png 1162w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak-300x179.png 300w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak-768x459.png 768w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak-1024x612.png 1024w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak-87x52.png 87w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak-150x90.png 150w, https://www.vpnmentor.com/wp-content/uploads/2018/03/hotspot_shield_ip_leak-500x299.png 500w&quot; sizes=&quot;(max-width: 847px) 100vw, 847px&quot; /&gt;&lt;/noscript&gt;&lt;p id=&quot;caption-attachment-99435&quot; class=&quot;wp-caption-text&quot;&gt;Our IP address was revealed when we tested it.&lt;/p&gt;&lt;/div&gt;\n&lt;p&gt;This means that when Hotspot Shield sees &lt;strong&gt;the parameter a1fproxyspeedtest&lt;/strong&gt; in any URL, it routes &lt;strong&gt;all traffic to the proxy hostname provided by the server parameter&lt;/strong&gt;. Therefore, if a hacker redirects someone who is using HSS to https://example.com/?act=afProxyServerPing&amp;server=mywebsite.com,&lt;strong&gt; that website will get a hit from the user’s actual IP address.&lt;/strong&gt;&lt;/p&gt;\n&lt;p&gt;We found similar vulnerabilities in Zenmate VPN and PureVPN. &lt;strong&gt;While Hotspot Shield already updated their service with a patch, we hope this will prompt the other VPNs to do the same.&lt;/strong&gt;&lt;/p&gt;\n&lt;h2  class=&quot;js-tocItem&quot;&gt;&lt;span id=&quot;Additional-research-on-ZenMate-and-PureVPN&quot;&gt;&lt;/span&gt;&lt;strong&gt;Additional research on ZenMate and PureVPN&lt;/strong&gt;&lt;/h2&gt;\n&lt;div class=&quot;im_history_message_wrap im_message_focus&quot;&gt;\n&lt;div class=&quot;im_message_outer_wrap hasselect&quot;&gt;\n&lt;div class=&quot;im_message_wrap clearfix&quot;&gt;\n&lt;div class=&quot;im_content_message_wrap im_message_in&quot;&gt;\n&lt;div class=&quot;im_message_body im_message_body_media&quot;&gt;\n&lt;div&gt;\n&lt;div class=&quot;im_message_media&quot;&gt;\n&lt;div&gt;\n&lt;div&gt;\n&lt;h3  class=&quot;im_message_document_caption&quot; &gt;ZenMate’s webRTC leak&lt;/h3&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;/div&gt;\n&lt;div class=&quot;im_history_message_wrap im_grouped&quot;&gt;&lt;/div&gt;\n&lt;div class=&quot;im_history_message_wrap im_grouped&quot;&gt;\n&lt;div id=&quot;attachment_99592&quot; style=&quot;width: 1024px&quot; class=&quot;wp-caption aligncenter&quot;&gt;&lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-319718484&quot; href=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM.png&quot;&gt;&lt;span class=&quot;img-lazy-wrap&quot; style=&quot;max-width: 1024px; margin: 0 auto;&quot;&gt;&lt;span style=&quot;float: left; position: relative; display: block; padding-top: 34.38%;&quot;&gt;&lt;/span&gt;&lt;img aria-describedby=&quot;caption-attachment-99592&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99592 size-large&quot; data-with-lazy-wrap data-src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-1024x352.png&quot; alt=&quot;&quot; width=&quot;1024&quot; height=&quot;352&quot;   /&gt;&lt;/span&gt;&lt;noscript&gt;&lt;img aria-describedby=&quot;caption-attachment-99592&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99592 size-large&quot; src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-1024x352.png&quot; alt=&quot;&quot; width=&quot;1024&quot; height=&quot;352&quot; srcset=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-1024x352.png 1024w, https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-300x103.png 300w, https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-768x264.png 768w, https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-151x52.png 151w, https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-150x52.png 150w, https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM-500x172.png 500w, https://www.vpnmentor.com/wp-content/uploads/2018/03/Screen-Shot-2018-03-04-at-1.25.22-PM.png 1880w&quot; sizes=&quot;(max-width: 1024px) 100vw, 1024px&quot; /&gt;&lt;/noscript&gt;&lt;/a&gt;&lt;p id=&quot;caption-attachment-99592&quot; class=&quot;wp-caption-text&quot;&gt;A simple check was able to determine that ZenMate’s VPN leaked our location.&lt;/p&gt;&lt;/div&gt;\n&lt;/div&gt;\n&lt;h3  &gt;PureVPN’s leak&lt;/h3&gt;\n&lt;div id=&quot;attachment_99594&quot; style=&quot;width: 1024px&quot; class=&quot;wp-caption aligncenter&quot;&gt;&lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-136922644&quot; href=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak.png&quot;&gt;&lt;span class=&quot;img-lazy-wrap&quot; style=&quot;max-width: 1024px; margin: 0 auto;&quot;&gt;&lt;span style=&quot;float: left; position: relative; display: block; padding-top: 42.38%;&quot;&gt;&lt;/span&gt;&lt;img aria-describedby=&quot;caption-attachment-99594&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99594 size-large&quot; data-with-lazy-wrap data-src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-1024x434.png&quot; alt=&quot;&quot; width=&quot;1024&quot; height=&quot;434&quot;   /&gt;&lt;/span&gt;&lt;noscript&gt;&lt;img aria-describedby=&quot;caption-attachment-99594&quot; loading=&quot;lazy&quot; class=&quot;wp-image-99594 size-large&quot; src=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-1024x434.png&quot; alt=&quot;&quot; width=&quot;1024&quot; height=&quot;434&quot; srcset=&quot;https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-1024x434.png 1024w, https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-300x127.png 300w, https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-768x325.png 768w, https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-123x52.png 123w, https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-150x64.png 150w, https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak-500x212.png 500w, https://www.vpnmentor.com/wp-content/uploads/2018/03/pure_vpn_ip_leak.png 1188w&quot; sizes=&quot;(max-width: 1024px) 100vw, 1024px&quot; /&gt;&lt;/noscript&gt;&lt;/a&gt;&lt;p id=&quot;caption-attachment-99594&quot; class=&quot;wp-caption-text&quot;&gt;Visiting a website using the Firefox browser revealed our IP address with PureVPN.&lt;/p&gt;&lt;/div&gt;\n&lt;p&gt;We will not go into detail about PureVPN’s and ZenMate’s vulnerabilities (please see each VPN’s response below). While they are not exactly like HotSpot Shield’s vulnerabilities, they are similar.&lt;/p&gt;\n&lt;h2  class=&quot;js-tocItem&quot;&gt;&lt;span id=&quot;VPNs-responses&quot;&gt;&lt;/span&gt;&lt;strong&gt;VPN’s responses&lt;/strong&gt;&lt;/h2&gt;\n&lt;h3  &gt;&lt;strong&gt;Hotspot Shield:&lt;/strong&gt;&lt;/h3&gt;\n&lt;p&gt;After fixing the vulnerabilities, Hotspot Shield contacted vpnMentor with this message.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;“The researchers hired by vpnMentor did not find any vulnerabilities in the mobile or desktop versions of Hotspot Shield. The vulnerabilities they reported were &lt;strong&gt;present only in the free Chrome plug-in&lt;/strong&gt;. Neither mobile nor desktop users of the Hotspot Shield app were affected by these vulnerabilities. We appreciate and commend vpnMentor’s initiative to improve the security of consumer VPN applications, and look forward to seeing more research from their side involving more VPN products in the near future.”&lt;/p&gt;\n&lt;h3  &gt;&lt;strong&gt;Zenmate:&lt;/strong&gt;&lt;/h3&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;“I would like to give you some more background to the security issues vpnMentor found in ZenMate’s browser extension. We appreciate the work from vpnMentor in pointing out potential problems as the security and privacy of our users are very important to us and we put a lot of effort in to protect that. In fact, we are one of the very few commercial VPN companies operating under very strict German privacy laws and do not track, log or sell the data of our users, as opposed to many other companies in this field.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;We are aware of that situation since Google introduced WebRTC in its Chrome browser and of the fact that there are possible privacy implications of WebRTC as they are generic to every VPN and not only affecting ZenMate users. Additionally, we are very transparent and open with the communication to that: We have a support article (https://zenguard.zendesk.com/hc/en-us/articles/201259661-How-can-I-protect-myself-from-IP-leaks-caused-by-Flash-or-WebRTC-) that explains this issue and also tells the user how what to do to prevent IP leaks (for example to install the extension WebRTC Leak Prevent). Moreover, we also mention that on the description of the extension in the Google Chrome Webstore.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;One of the reasons why we decided not to block that in our extension like some of our competitors do is that there are some webservices out there that rely on WebRTC. WebRTC is a complex matter and just disabling it without educating the user on possible downsides is unfortunately not an option for us, as we thrive to provide the best user experience possible in our products. Many services rely on P2P realtime communication to function properly, e.g. Google Hangouts would stop working if WebRTC would be disabled.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;To solve that issue immediately for our users we suggest to install the extension WebRTC Network Limiter (https://chrome.google.com/webstore/detail/webrtc-network-limiter/npeicpdbkakmehahjeeohfdhnlpdklia?hl=de&amp;) and select the 4th option (see attached picture). However, we understood that this might not be clear enough and currently work on a dedicated new product to specifically protect against possible WebRTC privacy issues in a new user-friendly way. This new product will be promoted through our VPN extension whenever WebRTC is being used and interconnects with our VPN offering in a seamless way.”&lt;/p&gt;\n&lt;h3  &gt;&lt;strong&gt;PureVPN:&lt;/strong&gt;&lt;/h3&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;“In continuation of our communication regarding the article recently published on vpnMentor regarding VPNs leaking users’ IPs, I have updated you our stance on it.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;The Firefox browser, by default, has an inherent limitation where it makes it almost impossible to identify and differentiate remote and local hosts. Our intention was to allow users the freedom to access all local domains conveniently while using our extension.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;I am sure that the tests you carried out were not on the latest build, since it has already been patched.&lt;/p&gt;\n&lt;p style=&quot;padding-left: 30px;&quot;&gt;The Firefox store clearly shows that our extension was last updated on March 07, 2018, and this update included the fix for the above-mentioned issue.”&lt;/p&gt;\n&lt;h2  class=&quot;js-tocItem&quot;&gt;&lt;span id=&quot;What-does-this-mean-to-a-VPN-user-&quot;&gt;&lt;/span&gt;&lt;strong&gt;What does this mean to a VPN user?&lt;/strong&gt;&lt;/h2&gt;\n&lt;p&gt;&lt;strong&gt;VPNs are not as safe as many may think. &lt;/strong&gt;&lt;/p&gt;\n&lt;p&gt;The fact that we found leaks in all the VPNs that we tested is worrying.&lt;/p&gt;\n&lt;p&gt;&lt;strong&gt;Our guess is that most VPNs have similar leaks and that users should take this into consideration when using VPNs&lt;/strong&gt;. If you use Hotspot Shield or PureVPN user make sure you have updated your app. If you are a user of Zenmate, make sure you are aware of the (minor) vulnerability that we have indicated and follow Zenmate’s instructions.&lt;/p&gt;\n&lt;p&gt;&lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-244571215&quot; href=&quot;https://www.facebook.com/sharer/sharer.php?u=https%3A//www.vpnmentor.com/blog/vpn-leaks-found-3-major-vpns-3-tested/&quot; target=&quot;_blank&quot; &gt;Share these results on Facebook&lt;/a&gt; or &lt;a name=&quot;VPN Leaks Found on 3 Major VPNs out of … 3 that We Tested-532651794&quot; href=&quot;https://twitter.com/home?status=3%20out%20of%203%20popular%20VPNs%20were%20found%20to%20have%20leaks.%20https%3A//www.vpnmentor.com/blog/vpn-leaks-found-3-major-vpns-3-tested/&quot; target=&quot;_blank&quot; &gt;tweet about this.&lt;/a&gt;&lt;/p&gt;\n"
<https://www.vpnmentor.com/blog/vpn-leaks-found-3-major-vpns-3-tested/>