Welcome to Part 10 of this module.
This video is going to be covering VPN ins or virtual private networks.
We'll talk about what a VPN is.
Some of the pros and cons of using one as well as discussing ways of comparing VPN is to select which
one is best for your purposes.
In the course of this demonstration you'll see me use several such commercial offerings both free and
not free.
I'm not sponsored by any company nor am I advocating the use of any specific service that you may see
here.
The goal of this presentation is to give you the informational need to make your own selection not make
the selection for you.
And as promised towards the end of this entry we'll be discussing vpn use with Tor.
That being said there are some parts of the world where the use of virtual private networks is illegal
and can get you into hot water.
Please always use such technology in a way that is consistent with the laws of whatever country you're
living in at the time of this video.
A VPN is perfectly legal in the United States and hopefully always will be.
But since laws are ever changing please do a bit of research to make sure that they are legal for your
area before you use one.
So first what is a VPN.
The simplest way of explaining is to say that a virtual private network is encryption technology that
forms a secure connection or tunnel between your computer and the VPN server.
In theory anyone outside this tunnel such as your Internet service provider or a hacker attempting a
man in the middle attack at the local coffee shop will see only encrypted data going to and from the
server a network administrator of a shared network as well as a network firewall will only see encrypted
data VPN technology was originally developed to allow remote users and the branch offices of businesses
to access corporate applications and resources to ensure security.
The private network connection is established using an encryption layer Tunneling Protocol and VPN users
use authenticated methods including passwords and certificates to gain access to the VPN in other applications.
Internet users may secure their transactions with a VPN to circumvent geo restrictions and censorship
of various kinds or to connect to proxy servers to protect personally identifiable information and location
information thus allowing you to stay anonymous on the internet.
However it has to be said that some Web sites do block access to known VPN technology to prevent the
circumvention of their geo restrictions and many providers have been developing strategies to get around
these roadblocks.
A VPN is created by establishing a virtual point to point connection through the use of dedicated circuits
or with tunneling protocols over existing networks while connecting through a properly configured VPN
tunnel.
All of your internet traffic will be encrypted to and from the VPN server if you set up a VPN server
on your home computer and connect to it.
Let's say from a faraway library network then the traffic between the computer you are using in your
home computer is encrypted and any Web site that you work to visit will see the IP address of your home
computer.
On the other hand if you connect from your home computer to a VPN server in let's say Mumbai any attempt
to trace your activity or location will lead to the server in Mumbai not your home address.
Penetration testers often use VPN ads in order to hide what they are doing during a lawful penetration
test.
A VPN is often used to form a secure tunnel through an otherwise impenetrable firewall.
It can be used to hide Internet activity from nosy system administrators as well as internet service
providers and prevent the pen testers activities from being traced back to their source or directly
logged.
There are basically three types of virtual private network.
The first type is a network that you set up yourself using free open VPN technology.
In this instance you must have access to your own server somewhere in the world.
This might be a virtual private server purchased through anonymous means or a physical box that you
own.
Somewhere out there you could of course use your own home computer and this might be desirable when
traveling.
Just keep in mind your Internet activity will always appear to be originating from that point and can
be easily linked to your identity.
The second possible implementation would be a free VPN.
If you work for a security conscious company they are likely to provide this as a service.
This is after all how VPN is originally started out.
There are many so-called free VPN is being offered online and we'll look at a couple of those during
this tutorial.
There are some major issues with free VPN however and I'll get to those in a second.
The third type of implementation of VPN is a commercial offering.
In the last 10 years or so VPN providers have really taken off for as little as a few dollars a month.
You can subscribe to one of these providers and have access to hundreds of VPN servers all around the
world.
All providers are obviously not created equal.
And we'll be discussing pros and cons of commercial offerings in a moment.
At this moment I am currently connected to a VPN a commercial offering called Tor guard to a server
in Los Angeles California.
If we decide to navigate over to what's my IP address we can see that any Web site I visit or service
I connect to will see this IP address and this geo location.
In other words if I were conducting a lawful penetration test and as part of that lawful pen test gained
access to somewhere I normally would not supposed to be.
Any attempt to trace my activities would lead back to this server in Los Angeles.
My ISP would only see encrypted traffic to and from the server so there would be no way to determine
what I was doing.
Obviously there is a major caveat here.
You have to trust the VPN server that you are connecting to.
You have to trust that one they say they don't log your activities or grant third party access that
they are actually telling you the truth and you have to trust that the company itself is not in some
way compromised.
For example by an intelligence agency you might therefore assume that a free VPN is the way to go over
a commercial provider such as the one that your seeing your theoretically has an incentive to protect
their customers whereas a free provider can do as it pleases with your data.
It may then seem that the best solution would be to set up your own server but unless you personally
control the server itself how can you really trust it.
And if you own the physical server is it not linked to your identity in some way.
I realize it may seem as if I'm sabotaging the very reason behind using a VPN.
My goal is to alert you to the dangers of whichever choice you decide to go with a virtual private network
is an incredibly useful tool when used properly but it's not by itself.
Absolute anonymity.
A VPN isn't going to help you if you're logging into your Google accounts and allowing them to essentially
track you across the Internet.
Just like with Tor.
Proper operational security or OPSEC for short is crucial.
Let's take a look at a practical example of what you might want to use a VPN for.
First off I'm going to disconnect from the network and choose another server notice that when I do this
my internet connection down here is going to go dead.
Any good VPN provider whether it is one you set up yourself or a free client with that you download
or a commercial offering is going to absolutely require a functioning internet kill switch.
It may happen that for some reason your connection to the VPN server drops without warning and if such
a kill switch does not exist or is not configured properly your Internet activity and real IP address
will be unmasked every VPN client is a little different and we'll see a few more examples in a moment.
This one in particular has a button on the front to re enable the network devices and restore Internet
connectivity.
So I'm going to click it now.
We've reconnected and I'm going to go ahead and select another server from the list every provider is
different.
Commercial offerings will often have extensive lists of servers all over the world.
Generally speaking with a free provider you simply get whatever is offered and the selection is usually
quite a bit less impressive.
So for this demonstration I'm going to go ahead and connect to Atlanta in the United States
with this being done or IP address.
As far as the outside world is concerned will reflect this.
Atlanta server our geo location has changed and if we come over to what's our IP and refresh it we can
see that our IP address has changed as well.
So let's say that we want to download a perfectly legal iso image from a freely available Linux distribution
for our example purposes it's going to be Calleigh.
The best way to do this would be to use a file sharing client such as BitTorrent you torrent or any
number of others.
Since this method allows us to pause a download and resume it later it also allows us to draw the same
files from multiple sources at once rather than just trusting one single source taunting is not in and
of itself illegal in the United States.
Contrary to what you may have heard however it is illegal to use this method to download other people's
intellectual property such as movies television shows music books audio books or anything else that
you don't have permission from the creators to download as this would fall under the category of piracy.
Please obey the law at all times.
With that being said we will be downloading Linux which is freely offered and not copy written many
Internet service providers frown on taunting because when they see the activity they assume by default
that such traffic is in some way illegal.
Some will even go so far as to throttle your internet connection speed when they automatically detect
this sort of activity.
And of course it may also be that you just don't want there to be a record that you downloaded Cally
Linux so we're going to go ahead and click the torrent link and this is automatically going to open
up my rather out-of-date file sharing client.
Here we can see that the Linux iso image is downloading because we are connected to the VPN server.
All our internet providers CS is encrypted traffic going to and from the server.
Anyone observing the connection tried to determine who is downloading this file would see the IP address
of the VPN server not our own.
Of course downloading files or performing other packet heavy activities such as online gaming while
using a VPN may be slower than using your regular connection.
So this is something to keep in mind.
Speed will vary from server to from server to server configuration to configuration and provider to
providers so so just be aware of that.
Now the reason we absolutely must have a proper kill switch method employed is because if we were to
disconnect for any reason noticed the download speed is decreasing.
What's actually happening is that it's stopping immediately.
This is just how but this particular client expresses this and if I'd let this go a bit longer the drop
would be more apparent.
We want to make sure that whatever we are doing immediately stops without such a kill switch or something
of the kind being used.
This download would just continue on without any interruption.
A real IP would be shown in the clear and our ISP or network at ad men would be able to log what we're
doing.
As it stands the download stops immediately.
So we'll go ahead and we will pause this exit out of our client re enable our internet connection and
now we can click connect to reconnect and there we go.
We're once again connected we could load up new torrent once again and simply click resumed download.
So that was one example of a VPN two more popular examples of free VPN ads are going to be cyber ghost
and Proton VPN.
Now the reason I'm showing this next step in virtual box is to make a point about split connections.
The first example of a freebie VPN provider that I was going to show you was called cyber ghost being
free.
It has far fewer server options but all that is required to sign up is a burner email.
Unfortunately cyber ghosts authentication for the free accounts appears to be down and has been down
for the last few hours.
So.
Well I guess being free.
You get what you pay for.
Sorry cyber ghost so instead we're gonna go ahead and we're going to look at proton VPN which is also
free and can also be signed up for simply by signing up for the free proton mail to make this prettier
to look at.
I'm going to go full screen and virtual mocks proton VPN has a rather nice looking client in my opinion
as before we select our server in whatever country we want from the list provided all you'd need to
do to sign up is create a free account using proton mail.
I do still have the free trial so we're seeing more servers than would normally be available with the
free version.
We also have the option of using what proton VPN calls secure core which creates an additional bit of
routing through Iceland before carrying on to our chosen destination which in this case is Brazil.
But hang on a second.
If we minimize virtual box we can see that we're still connected to the Atlantis server through our
other example VPN.
This is a crucially important thing to remember since we often use virtualize systems for pen tests
and even in day to day use virtual box uses its own Internet adapter.
Even if you're connected to a VPN on the host operating system virtual box basically just ignores it
and uses your real connection.
If you want your virtual box traffic to be protected you need to use a VPN inside virtual box itself.
The neat thing is that it is possible to use virtual box in this way to be connected to multiple VPN
is all at once all from the same computer.
Each one will have its own unique IP address and they don't even have to be the same VPN Provider.
One thing to be aware of however when using a VPN and virtual box is that the Internet kill switch that
usually comes with these clients can be extremely unreliable.
Sometimes it just doesn't work properly in a virtualize environment.
So make absolutely sure to test the kill switch extensively before you put any degree of trust into
it.
OK so I've gone back into full screen mode so we can see this spiffy looking map and how our connection
is being routed.
And as you can see this can get quite complicated.
Bouncing the connection all over the map between various points.
You can do this multiple times once again.
I'm not advocating any particular service here.
These are just quick examples.
So how then do you make an intelligent decision about which VPN to choose.
Well there are many things to weigh in.
Consider first and foremost you want to read through a VPN providers privacy policy very very carefully
who if anyone do they share information with what information do they share.
If any do they keep logs of your traffic.
Do they retain fact of connection records.
What jurisdiction are they operating in.
What kind of reputation do they have.
One problem with both commercial and free VPN providers is that sometimes they flat out lie.
There is also the fact that the world has become a very complicated and interconnected place.
Some governments most notably the United States pretty much have the authority to go to a VPN Provider
in their jurisdiction and prevent them with a secret letter demanding they betray their customers and
not reveal the fact even when this is not done there are intelligence sharing treaties between nations
that are so labyrinthine I don't even want to go into them.
These agreements between countries tend to be referred to as the Five Eyes Nine Eyes and 14 eyes respectively.
Think of them like planetary orbits the Five Eyes are composed of the United States the United Kingdom
New Zealand Canada and Australia.
They basically share everything.
It is pretty handy for them because their own laws prohibit unlawful surveillance of their own citizens.
But those laws do not prohibit let's say hypothetically Great Britain from scooping up American data
analyzing it and then trading it to an American intel agency in return for an American intel agency
scooping up British data analyzing it and trading it back to them again hypothetically this sort of
warrantless surveillance is a massive rabbit hole and it is one that is well beyond the scope of this
tutorial to dive into.
But I do encourage you to research this a bit on your own to get some idea of just how these things
actually work.
But the basic point I'm trying to make is that in a world of secret FISA letters and global surveillance
how can we trust any VPN Provider.
My personal opinion is that no provider can be absolutely trusted but as has been said setting up your
own server has its own set of complications.
A virtual private server that you purchase from a provider is subject to the same national laws as a
VPN provider in that country.
If you control the physical server Well that's great.
You can be sure it isn't storing any logs or doing anything sneaky.
But how do you control it without linking it to your own identity in some way.
And if it is remote do you really control it.
So back to the original question.
How would you make an intelligent coherent choice.
This Web site is simply the best resource that I have yet found.
Here we have a comprehensive chart of all the major VPN providers and if we scroll around we can see
details about them.
There is of course a search feature we can see such information as the jurisdiction we can see if the
jurisdiction in question is part of the publicly known about intelligence sharing alliances whether
or not it logs traffic logs and DNS requests.
Fact of connection timestamps bandwidth usage connecting IP et cetera et cetera.
It tells you whether or not it supports paying for your account anonymously.
And this is something that I'll talk about more in a moment.
And you can see that there are quite a few categories for it since there are quite a few methods of
paying anonymously.
It tells you if it's.
It tells you if the provider offers PDP keys does it support privacy causes.
Does it mean private.
Does it meet privacy tool Io criteria and so on and so on.
As we continue to scroll there are many important data points presented.
If you are considering using any VPN provider I strongly encourage you to come to this chart or one
like it and see how it stacks up.
Relying only on reviews is not a good idea because many of the reviews that come up were paid for by
the providers themselves.
It is very important to research carefully on your own.
What this ultimately comes down to is trust.
Who do you trust which sources do you trust.
A VPN provides a lot of protection and advantages.
It can be used to connect through firewalls sometimes even on a national level.
It can be used to get around geo location restrictions such as for example if you live in the United
States you could unblock the BBC by connecting to a server in England.
There are even times when you might be able to get plane tickets at a cheaper price depending on which
part of the world you appear to be in at the time you visit the website.
It prevents your ISP from mass scooping your data or seeing what it is that you are doing online and
potentially disapproving.
Your VPN provider might lie to you about keeping logs but your ISP most definitely logs everything you
do.
Long standing providers with good reputations are at least worth considering for this reason.
It is possible to make a VPN simply one step in your security rather than having it be the entire picture.
You can add proxies to the mix using in conjunction with Tor or any number of other implementations
to make it more difficult for any one failure in the chain to lead to the exposure of your sensitive
data.
The other thing I want to talk about is paying anonymously.
Several major VPN providers allow you to pay for the service in a number of ways that do not linked
directly to your personal identity.
The most obvious examples are Bitcoin and other forms of cryptocurrency but some even accept gift cards
that you buy in the store with physical cash.
Just as an example you could buy a gift card at your local Best Buy using cash.
The card has no connection to your identity.
You then enter the card number in at the time of payment.
If your VPN supports it along with other bogus information that sometimes the VPN service itself provides
you with Be sure to use a burner email and there you go.
No VPN can ever be trusted completely and absolutely neither can tor for that matter or proxy chains
or any other method you can think of to obfuscate your identity.
But if you use them properly and if you take the necessary steps you can greatly improve your security
and privacy.
Imagine that you take a burner laptop bought with cash to a coffee shop or library use a VPN purchased
anonymously throw in a few extra hops and or proxy chains or maybe even Tor and yeah you can feel reasonably
confident that you are beyond tracking never completely confident but reasonably confident a good VPN
is there for a superb tool for legal penetration testing and other activities such as legal taunting
of legal files.
But you absolutely must do your research make sure you can get the VPN anonymously make sure that they
don't store information make sure that their reputation is actually good.
Make sure you are comfortable with the jurisdiction they are operating in.
And remember that while your ISP only sees encrypted traffic going to and from the VPN server the VPN
provider itself can see everything that you do.
So now we come to the six million dollar question.
Should I use a VPN in conjunction with Tor.
As you might expect the answer is complicated and boils down to who you trust and what you're trying
to do online.
There is no easy right answer when you're using Tor your Internet service provider and whoever runs
your local network can clearly see that you're using Tor they don't know what you're doing with it but
they know that you're using it.
If you're running tour through a VPN then the provider and the network admin see VPN traffic the VPN
Provider sees encrypted traffic going to the TOR entry node the provider can't see what you're sending
to the entry point of the Tor network but it can see that you are connected to the entry point and can
measure your exact traffic volume.
The Tor entry node can also see your real IP address when you're not using a VPN and you connect to
it and that can be an issue.
If the node has been compromised so on the surface this seems like a really good idea.
If the Tor network were compromised such as for example an entry and exit node being controlled by the
same hostile entity wouldn't routing through a VPN be an extra layer of security.
Well maybe but the creators of Thales contend that a VPN also represents an additional possible point
of failure and therefore they advise against it.
Their reasoning goes something like this whether or not tor plus a VPN is a good idea depends on your
threat model.
Local laws operating system setup behavior in a number of other factors.
For example let's assume you're a journalist studying a police corruption case.
If your country's ISP fees are protected by common carrier rules in other words the message is sent
are legally protected in the same way that physical mail is then transmitting content via the VPN is
risky.
The VPN provider isn't a common carrier and therefore doesn't have the same legal protection.
They go on to argue that if the VPN server is compromised in some way this could lead to your fact of
connection to the TOR network being leaked although I personally fail to see how this matters since
without a VPN.
This information is clearly visible to your ISP anyway.
It may be a consideration.
Finally there is the valid point that in adding a VPN client to the Tor client you've got another piece
of software which may contain bugs such as remote code execution.
It is my opinion and I want to stress the word opinion that a belt and suspenders approach is a good
idea.
Provided that you've paid anonymously and that you trust your VPN provider is not storing your connection
information.
If the Tor network fails or is already compromised in some way the VPN represents an extra level of
security as I said though there is no clear right answer.
Security professionals of great skill and tenure have posted many arguments both for and against the
combination of VPN and Tor and a quick search online will present you with plenty of material to chew
on.
If you trust your VPN more than your ISP and or network admin or if it is crucial that these groups
not be able to see that you are using Tor then a VPN might be the way to go.
If on the other hand you think I'm wrong or that a VPN provider might be a point of compromise particularly
for legal reasons relating to your home country or those already detailed by all means stick to Tor
alone.
Your level of security concern will probably dictate these choices for most users.
It really isn't necessary to be this paranoid but if your life depends on your security as it may in
some parts of the world these are things to think about very very carefully.
Always do your due diligence and make sure the solution you pick is carefully researched for both the
pros and the cons before it close out.
I will also add that using a VPN and Linux is really no different than Windows these days.
Almost every VPN Provider both free and commercial offer a Linux client and as I said you can always
download the free software and set up your own VPN server and client.
If you're so inclined again it all comes down to what you need your security to do for you.
Thank you for your attention.