A Virtual Private Network (VPN) is not as private, safe or secure as you might think if you are using it to circumvent geographic resections, obfuscate your Internet address or investigate the dark web.
Simplistically, a VPN creates an encrypted tunnel between two environments. If this tunnel connects you directly to a denied, contented or hostile environment, then you may have a problem. VPNs provide an express route for attackers into your computer and can expose your entire network to infiltration and compromise. A VPN won’t protect you from malware or phishing attacks. Ironically though, a VPN gives users a false sense of security. As the use of VPNs has risen with remote work, so have the number of vulnerabilities in these systems which have been targeted and exploited by attackers.
Free or cheap VPNs are popular for watching movies, web browsing or conducting research in a less-attributable manner. But remember, if it is free, then you are the product. Many of these VPNs are like a public washroom but shared with hackers, child predators, criminals, pirates, hostile intelligence services. Re-using an Internet address is like buying a ghost gun off the street for home defence but one which has a history of violent crime traced to the serial number. Your privacy isn’t always guaranteed nor will it provide complete anonymity. These services are flagged as VPNs and often fail to circumvent censorship, surveillance or streaming blocks. Moreover, discovering using a VPN in some countries can get you arrested or worse. A number of public VPNs are just dangerous.
Many organizations use foreign VPN services to conduct their more sensitive online operations without any assurance that what they are doing isn’t monitored.
For security research or open source intelligence investigations, what you need is a trust-worthy managed attribution system that can cloak and protect your identity and the nature of your investigation while securing the session against sophisticated threats.
The three (3) principal features of a trustworthy managed attribution service are Protection, Privacy and Performance:
A trust-worthy managed attribution service is built upon a sovereign and secure supply chain that clearly identifies who has designed, built, deployed and is managing your service - free of Foreign Ownership Control and Influence (FOCI). There should be technical and procedural security controls in place to provide this assurance or the system ought to have undergone some form of Security Assessment and Authorization (SA&A), certification and accreditation. The facilities, operations and personnel should also be security vetting/cleared to at least the level-of-operations that they are supporting. The company should be able to protect your identity, protect your interests and safeguard your activities throughout the service engagement (communications, contracting, financials, help desk etc). The software for the managed attribution service should not be intrusive, deeply impeded system software or otherwise potentially introduce security exposures.
The system needs to be backstopped against infiltration by a sophisticated adversary. A full-suite of security safeguards should be integrated within the system. This could include: Extended detection and response (XDR) technology, Domain Name Services (DNS) and Malware protection supported by Active Cyber Defence, and Threat Hunting tied to Security Orchestration, Automation and Response (SOAR). In addition to cloaking the session, the system should offer a secure containerized space to download content from dangerous sites. An overwatch capability supported by Cyber Threat Intelligence (CTI) would monitor the whole managed attribution network and watch your back for the first signs of trouble.
The system egress nodes and assigned address space should be clean and unique to a user. Similarly, the network cannot be identified as a VPN or managed attribution service.
The service provider should be resident in-country where they are bound by domestic laws and your interests are fully protected..
The managed attribution service needs to have been engineered with privacy by design to cloak both the identity and activities of the users from detection and counter-surveillance using multiple hops, ingress and egress nodes – making it untraceable even by a the most sophisticated adversary. Such a system needs to support persona management, persistent and ephemeral connections.
Domestic laws cover your individual privacy only if the service provider is located in-country and all the components and operations are fully within their control. The provider should be able to demonstrably assure that your activities are invisible to them and any personal identifiable information (PII) is protected according to law.
The managed attribution service should not adversely affect the efficacy of your Internet services including high-bandwidth applications like gaming and streaming video, even when circumventing denied environments.
The solution needs to be simple, safe and transparent for users. Ideally launched right from a web browser.
In summary, the service should provide optional on-demand, secure, private, anonymized ephemeral networks, global ingress and egress nodes (fixed, dynamic, and mobile) to the workspace integrated with an investigative desktop - at the push of a button.
Such a system needs to be easily deployable and scalable at low-cost. For this reason, bespoke or Do-it-Yourself (DYI) solutions are simply not safe or effective because they often lack in-house expertise and economies of scale. They are typically orders-of-magnitude more expensive to maintain than comparable commercial products, while the nature of their design leaves unique signatures and digital exhaust.
Sapper Labs develops ground-breaking privacy enhancing technology. We operate a trusted sovereign secure cloaked analytical environment for on-line individual privacy and managed attribution, in support of online research and investigations.