UFO VPN Leak: 20 Million Users Login Details Hacked

10 Reviews

October 7, 2021 at 7:57 am in News

UFO VPN Leak: 20 Million Users Login Details Hacked

Cyber-attacks and the misuse of data is at an all-time high. This is why individuals and organizations alike are taking active steps to protect themselves from cybercrime. However, it is important to realize that not all solutions and precautions are created equally.

Choose poorly and you could end up being the victim of the very attack that you were trying to prevent. This is precisely what happened to those who placed their trust in UFO VPN.

Breaking Down the UFO VPN Leak

UFO VPN is a Hong Kong-based VPN provider, providing free VPN services to customers around the world. Researchers at Comparitech discovered a leak, showing that information related to over 20 million user logs had been hacked. One of the databases hosted on an Elasticsearch cluster had been left without a password, resulting in the leak.

It is estimated that around 894GB of data was leaked. The hack allegedly resulted in the release of sensitive information. This includes, but may not be limited to plaintext passwords, IP addresses, sessions tokens, timestamps of user connections, geotags, and device and OS characteristics.

What is even more concerning was that Comparitech researchers informed UFO VPN of the leak on July 1^st, 2021. The company then claimed to have the secured the exposed data. Then, there was another second exposure on July 20^th, 2021. This contained even more information in the data set.

UFO VPN issued a statement blaming personnel changes for the hacks. They claimed that using new employees had caused the bugs in the firewall to go unheeded. Of course, the company also stated that they didn’t collect any personal information. However, the hack does show numerous personal details being leaked.

The Fallout

So, what does this mean for the victims of the hack? Well, it is certainly not good news.

One of the biggest issues related to this attack is the revealing of the plain-text passwords. To begin with, hackers can use these to hijack UFO VPN accounts. What is of greater concern, however, is that it can result in credential stuffing attacks on other accounts.

After all, most people will use the same password for multiple accounts. Thus, now that the hackers know the passwords, other accounts may be compromised as well. This could cause multiple breaches across the board.

Then, there is the issue of the IP addresses. The hackers can use this information to verify their online activity. It is also possible that it can reveal the user’s location as well. Considering that most people use VPNs to conceal their true activities, this can be especially worrying.

The leaked email addresses could lead to a host of targeted email scams and phishing messages. Since sessions secrets and tokens were also released, this could make further encrypted sessions pointless. There is a chance that if the hackers intercept data being sent across a compromised Wi-Fi network, they could decrypt the information.

Now, the very fact that UFO VPN was storing all of this information in the first place should be considered as well. Unsavory providers only do this so that they can pass on this information to third parties who will use it for their own needs. Due to this, there is no telling how much damage has already been done.

The Takeaway from UFO VPN Leak

This attack has exposed some interesting elements of cybersecurity. Although more and more people want to protect their data, they aren’t willing to pay for it. As a result, they end up registering with free providers, much like UFO VPN. It is clear, though, that this is major mistake.

Why are free VPN providers a poor choice? To begin with, these VPN providers have very little interest to safeguard your personal details and information. After all, you aren’t paying for the privilege. Thus, with such providers, security is largely up to the clients.

Their privacy standards are also quite lax, as seen by this event. Technically, a VPN shouldn’t be keeping any logs of events or storing IP addresses. After all, their main purpose is to help safeguard clients’ privacy.

At the end of the day, paid VPNs are the way to go. Yes, they may cost you money on a monthly basis but for what you get in return, it is completely worth it. As these companies are taking your money, they have to meet a higher standard of client privacy.

A paid avenue becomes even more important when you consider why you use a VPN. You are either using it to keep certain activities secret. And, just because you are using a secure Wi-Fi connection at home doesn’t mean that your information is safe. Your ISP provider has access to everything you do online and is often willing to sell that information on. Shockingly enough, this is perfectly legal to do.

This doesn’t automatically mean that every paid VPN is equal to each other. No, even in this industry, there are some that are better than the rest. One of the best VPNs that you can sign up with is Express VPN.

For one thing, the provider is very transparent regarding privacy and data usage. They assure consumers that they don’t store any kind of logs. This includes IP addresses, VPN IPs, session duration, or a connection timestamp. Best of all, the company only makes money from its subscriptions. Due to this, they will not sell your personal information to a third party or profit.

You don’t have to take the company’s word about its privacy policy. The provider was actually tested and authorities discovered that no information had been stored by the company. Therefore, your secrets are really safe with them.

This is the lowdown on the UFO VPN leak. There is no doubt it was a dreadful with millions of victims who have yet to experience the fallout from the attack. For the rest of the world, though, this leak has brought old problems and concerns to the surface once more. It is clear that free VPN providers simply can’t get the job done. It is detrimental that you sign up for paid and reputable providers.