Update: Actually, Hola’s security issues aren’t even worse than feared

further research reveals holas security issues are even worse than feared vpnheader
Vallepu
Update 6/3/2015 1:23 PM: Hola has informed us that Vectra’s claims have been partially retracted by the security firm. Vectra has clarified that Hola is not a botnet, but rather can be used to enable a botnet. Further, it appears that attack samples cited earlier only indicate attempted attacks against Hola users, not attacks proven to be successful.

As a result of these changes, Vectra has rescinded its broad recommendation that users uninstall Hola. Instead, the firm says “we highly encourage organizations to determine if Hola is active in their network and decide whether the risks highlighted in this blog are acceptable.” You can read the full post detailing those risks here.

Original text: Last week the free VPN service Hola Unblocker was revealed by security researchers to be acting as a botnet and selling its free users’ bandwidth through a premium service called Luminati. The security concerns meant someone could possibly gain control of your computer or carry out man-in-the-middle attacks.

A second team of researchers at cybersecurity firm Vectra has now published its own findings into the unblocking service, which it calls “both intriguing and troubling.”

According to Vectra, Hola not only acts like a botnet but has allegedly been designed to be able to carry out a “targeted, human-driven cyber attack on the network in which an [sic] Hola user’s machine resides.”

The researchers found that the VPN features a built-in console, or zconsole, that remains active even when the user is not currently browsing via Hola, allowing a malicious actor to list and kill any running process or open a socket to any “IP address, device, guid, alias or Windows name.” They could also install more software on the user’s computer without her knowing, says the report, and potentially bypass antivirus checks.

“These capabilities enable a competent attacker to accomplish almost anything,” says Vectra. “This shifts the discussion away from a leaky and unscrupulous anonymity network, and instead forces us to acknowledge the possibility that an attacker could easily use Hola as a platform to launch a targeted attack within any network containing the Hola software.”

Furthermore, Vectra analyzed the protocol used by Hola with the VirusTotal tool, which scans for malware. The researchers found five different malware samples that had existed on Hola before the recent news broke. “Unsurprisingly, this means that bad guys had realized the potential of Hola before the recent flurry of public reports by the good guys,” they wrote.

In response to the initial report from Adios, Hola!, who made the botnet claims against the VPN, Hola’s CEO Ofer Vilenski said on Monday that the company had patched two vulnerabilities identified in the report and that a vulnerability “has happened to everyone.”

Adios, Hola in its own reply said that it had in fact identified six vulnerabilities, not two, and rejected the claim that mistakes can happen. “As we have pointed out from the start, the security issues with Hola are of such a magnitude that it cannot be attributed to ‘oversight’; rather, it’s straight-out negligence,” they said. “They are not comparable to the others mentioned – they are much worse.”

The researchers have called for greater transparency from the Israeli company on its security issues. Vilenski added that Hola will launch a bug bounty program soon to identify any more vulnerabilities in the software.

Both Adios, Hola and Vectra are urging users to uninstall the program immediately. The plug-in or add-on has roughly 46 million users globally. Users of the service can route their traffic through other Hola users’ computers. The service is popular with people looking to access streaming sites like Netflix from countries where it has yet to launch.

Gaming

Microsoft CEO says Project xCloud is the ‘Netflix for games’

Microsoft CEO Satya Nadella referred to the company's Project xCloud game streaming service as "Netflix for games." The service will let users play Xbox and PC games on a variety of devices.
Social Media

Nearly 75 percent of U.S. users don’t realize Facebook tracks their interests

Did you know Facebook tracks your interests, including political and multicultural affiliations? According to a recent Pew study, 74 percent of adult users in the U.S. have no idea Facebook keeps a running list of your interests.
Gaming

‘Fortnite’ security flaw let hackers spy on players through microphones

A security vulnerability found in Fortnite allowed hackers to gain access to other players' accounts, potentially letting them spy on conversations using the in-game microphone. It has been addressed.
Computing

Getting Windows 10 updated doesn't have to be so painful

Windows update not working? It's a more common problem than you might think. Fortunately, there are a few steps you can take to troubleshoot it and in this guide we'll break them down for you step by step.
Computing

Data breach compromises 773 million records, 21 million passwords

A security researcher was alerted to a collection of breached data that included more than 773 million compromised records. After digging deeper, the breach was revealed to contain more than 21 million passwords.
Computing

Dell teases new XPS laptop with Intel’s 10th-gen Ice Lake for summer 2019

After teasing a mysterious Ice Lake-powered XPS laptop during Intel's keynote, Dell confirmed that it will announce a new 10th-generation Ice Lake-powered XPS laptop this year. The new XPS notebook could debut as early as summer.
Computing

Faster new PCIe 5.0 standard leapfrogs the best feature of AMD’s Ryzen 3

PCIe 5.0 will bring even faster data transfers, but it may only be found on HPCs and servers initially. The standard is four times faster than your current PC at transferring data, and new devices could appear later this year.
Deals

From Chromebooks to MacBooks, here are the best laptop deals for January 2019

Whether you need a new laptop for school or work or you're just doing some post-holiday shopping, we've got you covered: These are the best laptop deals going right now, from discounted MacBooks to on-the-go gaming PCs.
Computing

Keep your laptop battery in tip-top condition with these handy tips

Learn how to care for your laptop's battery, how it works, and what you can do to make sure yours last for years and retains its charge. Check out our handy guide for valuable tips, no matter what type of laptop you have.
Computing

Protect your expensive new laptop with the best Macbook cases

If you recently picked up a new MacBook, you’ll want something to protect its gorgeous exterior. Here, we've gathered the best MacBook cases and covers, whether you're looking for style or protection.
Computing

Watch out for these top-10 mistakes people make when buying a laptop

Buying a new laptop is exciting, but you need to watch your footing. There are a number of pitfalls you need to avoid and we're here to help. Check out these top-10 laptop buying mistakes and how to avoid them.
Computing

Don't spend a fortune on a PC. These are the best laptops under $300

Buying a laptop needn't mean spending a fortune. If you're just looking to browse the internet, answer emails, and watch Netflix, you can pick up a great laptop at a great price. These are the best laptops under $300.
Computing

Dell XPS 13 vs. Asus Zenbook 13: In battle of champions, who will be the victor?

The ZenBook 13 UX333 continues Asus's tradition of offering great budget-oriented 13-inch laptop offerings. Does this affordable machine offer enough value to compete with the excellent Dell XPS 13?
Product Review

LG Gram 14 proves 2-in-1 laptops don’t need to sacrifice battery for light weight

The LG Gram 14 2-in-1 aims to be very light for a laptop that converts to a tablet. And it is. But it doesn’t skimp on the battery, and so it lasts a very long time on a charge.