Questions and Answers (Q&A)

VPN service providers advertise with the promise of making Internet browsing more secure and protecting the user’s privacy. They also claim to make it possible using streaming services from other countries. But that’s not enough, they are even supposed to save you money when shopping online. Impressive. But is it true – are vpn worth it? I was asked to be an expert on this for a program on public television, but unfortunately had to cancel it. Nevertheless, I would like to explain my view on the advertising promises of VPN providers like NordVPN, ExpressVPN, ProtonVPN etc. Are VPN services worth it – is it useful or a rip off?

Basics of IP addresses and VPN

There’s no getting around of two basic IT topics. What is an IP address and what is a VPN anyway? In very simplified terms, an IP address in our example identifies an Internet access point. In my case, for example, this is currently 91.63.111.254 from the German Telekom. Due to the technical functionality behind it, we automatically send this IP to everyone, including Netflix, Amazon, booking.com, Google and all other providers, as soon as we use their services on the Internet or call up a website. This is not something the advertising industry or the government came up with for surveillance, this is just technical reality since several decades and will not change. It is similar to a sender address on a letter. Without it, you can’t deliver a reply.

A VPN is a virtual private network – private in the sense of non-public, not in the sense of privacy – and is used to connect private networks with each other or to provide access to a private network. The data traffic transmitted within it can be encrypted. Companies use VPN solutions, for example, to enable employees to access the company network from home via the Internet. A VPN is also often used to connect several company networks. The use of modern encryption techniques within the VPN also ensures the confidentiality and integrity of the transmitted data. Companies use solutions from hardware manufacturers such as Cisco and Juniper for this purpose – or use free open source software such as OpenVPN. The VPN providers mentioned at the beginning are not missing from this listing by mistake.

From a technical point of view, the use of a VPN provider can ensure that the website opened or the streaming service used no longer “sees” the actual IP address of your own Internet connection. Instead, it only receives an IP of the VPN provider as the remote station. Without evaluating this as an advantage or disadvantage, the use of such a VPN now brings the following technical features with it:

• the transmitted data is encrypted, at least from your own computer to the VPN provider
• your own IP address is not communicated to the service or provider (google, netflix, ..) you are using

From these two features, VPN providers now derive the following marketing promises.

Marketing Promise #1: Secure Internet

As described before, a VPN encrypts data – from the end device used to the end point of the VPN provider. After that, the data continues to be transmitted to the actual service used, as it would have been without a VPN.

If you use your online banking, Google, shop at Amazon, surf the daily news or read along here on the blog, the data is already encrypted – and thus secure – when it is transmitted over the Internet. The entire transmission path from the browser to the servers used to provide the service is already encrypted. While the use of SSL/TLS (https:// at the top of the browser bar) for encryption was rare in the past, it is now standard. Even if there are exceptions, a VPN provider also does not encrypt the entire data traffic, but only up to its endpoint. If the endpoint is in Russia and the destination in the USA, the data traffic is also transmitted across the globe without encryption.

The only advantage comes into play when the end device is being used in a public and insecure WIFI or WLAN. If you surf in a public Internet cafe on a non important insecure unencrypted website, then others can possibly intercept the data traffic. But you could also use the free Tor browser instead of paying for a VPN service. Solves the problem – if it really is a “problem” in the situation – and costs no money.

Marketing Promise #2: Privacy against user tracking

Advertisers use tracking via cookies, IP addresses, browser information, etc. to deliver personalized ads. Also the IP address of the used internet connection, but not only. Usually the IP used changes regularly even on one’s own connection, or one goes from home WIFI with a cell phone (IP from home), to the train using mobile data there (IP from mobile provider), goes to the company’s WIFI (IP from company), etc.

Using the IP to track a user is… a bad technical idea. There are exceptional cases where it may matter. Let’s say one has a fiber line at home with static IP (and pays the 400€ a month e.g. at Colt) and then wants to use video portals to view sexual acts. Yes, maybe I would use a VPN provider there as well. There is the question of how far it is relevant that a Cypriot company for adult online entertainment knows your own sexual wishes, but that would also bother me. Unfortunately, the VPN providers do not advertise this at all: Privacy at xHamster – keep secret that you like to lick dirty feet. Tell it only to us!

Marketing Promise #3: Remove Geo Fencing

There is a limited pool of IP addresses and they are assigned to companies or organizations. Companies have a location and thus sit in a country. Sometimes, the IP addresses used can be attributed not only to the country, but also to a rough location. Sometimes, rather inaccurate. Currently my IP address is assigned to the city of Munich, which is about 400km away from me. But the identification of the country works quite reliable. Germany, that is correct.

So as Netflix, for example, you can make sure that German customers can’t watch US movies on the American Netflix. This IP restriction can now be circumvented with a VPN provider, in the past you may used free proxies on the web for this. You simply select an endpoint of the VPN, which is located in America, for example. Netflix now thinks that you are an American customer. If you can now specify an American credit card, residence, etc., then this will work. Or you get stolen Netflix access data from America in the darknet and use a VPN provider that is located somewhere in the world, where American 3-letter agencies have no access to it. That’s not a call for it! But it is a use case. It’s just that no VPN provider advertises it here either: Use your stolen US Netflix credentials with DubiusVPN – 100% FBI protection!

Marketing promise #4: cheaper shopping

Other countries, other prices. Flights and hotels, for example, can cost less when marketed in Greece than in Germany. That’s not a rip-off at all, it’s a realistic pricing model and also depends on the costs in the respective country, the tax rates and laws there.

So far, so good, so if you want to book a vacation in Spain via a booking portal in Greece and you are sitting in Germany, a different price will be displayed there than in Germany – at least just because of the tax rates. A VPN can make sure that you can pretend to be a Greek user and book. Possibly one has again the problem with the indication of the domicile and the means of local payment. If one is successful, however, one has then also made the legal transaction in Greece and not in Germany. As soon as something goes wrong, it gets complicated. Nothing ever goes wrong on vacation: Flights are never cancelled. Hotel ratings are never fake.

For normal online shopping within a country, it doesn’t matter anyway. You can’t show potential customers from Kronberg am Taunus a higher price than customers from Frankfurt an der Oder. That is not technically possible, GEO-IP is too imprecise for that. What is technically possible, however, is to show customers with an iPhone a higher price than customers with a Google smart phone. However, no VPN provider would be able to help here.

Marketing Promise #5: Protection from DNS Leaks

Okay, I’ll let the VPN providers win: Anyone who sits in an Internet cafe (insecure WIFI) and calls up the website of his bank even encrypted has leaked something beforehand. His browser asks in the background via the DNS protocol, which IP address the servers of the bank website have. The moment one calls up the address in the browser. After that, all communication is secure and encrypted… but this information that you now wanted to know which IP addresses your bank’s server use for online banking – everyone there can see that. At least anyone with enough technical know-how and that is interested in it. If that bothers you, you could use a VPN provider – or just do online banking at home or from your work company.

Conclusion

I would not call the service of VPN providers a rip-off, but I find their marketing and advertising promises misleading. Their own representations of the advantages of VPN services in terms of security and privacy are not really wrong, but in context often without any further real benefit.

For most normal users, VPN services are unnecessary and so neither useful nor worth it. Those who really want or even need privacy should look at the Tor browser.

Those who use VPN services primarily to prepare or perform illegal actions (watching stolen Netflix accounts, script kiddie hacking) should not rely on the pseudo-anonymity of VPN services. There are more reliable ways of hiding yourself for this, which I can’t go into more depth here publicly. But the evil hacker (if he is good) does not use VPN services and the ethical hacker (in the sense of penetration testing) does not need it.

I read this a lot on the internet: I’m making familiar myself with Kali Linux! I want to learn Kali Linux! I’ve already installed Kali – now what? But what is Kali Linux anyway? How to learn Kali Linux? And is it really right for it to be so much in the spotlight?

What is Kali Linux?

Kali Linux is a free Linux distribution. It describes itself as an operating system aimed at various information security tasks – such as performing penetration tests, security research, computer forensics and reverse engineering.

What is Kali Linux based on?

Kali Linux is first of all just a Linux distribution based on Debian GNU/Linux, like Ubuntu Linux for example. Debian itself is a free open source operating system: Debian GNU/Linux is based on the basic system tools of the GNU project and the Linux kernel. It exists since 1993 and is appreciated by many Linux users as a very stable and free server operating system, but is also used as a desktop operating system. It has an exceptionally mature system for software package management, and is the mother – or father – of many other Linux distributions as well as Kali Linux. Kali Linux uses Debian Testing as its base. There is Debian in stable – that is the stable and well tested branch of Debian, which is always provided with security updates for a few years, but not with new functionalities. Kali is based on Debian Testing to get new versions of software packages on a regular basis. The publisher Offensive Security uses the large database of software packages from Debian Testing and complements it with other – free open source tools – for hacking or penetration testing. In principle, Kali Linux is just another Linux distribution based on Debian Testing with a few changes or additions.

How popular is Kali Linux?

Kali Linux is very popular, especially among hacking beginners. Primarily because it has the reputation as “the hacker Linux distribution” and is positioned accordingly in Offensive Security’s marketing. But most importantly, you don’t have to download and install various hacking tools from different sources, but can directly try and experiment with the installed hacking tools. That is the advantage of Kali Linux!

Is Kali Linux used in professional penetration testing?

Kali Linux is less used in professional penetration testing. On the one hand, you usually don’t need all the installed tools, but you need a stable Linux distribution for penetration testing instead that is not based on Debian Testing. There are penetration testers who have to use Windows as their operating system due to internal company requirements – my personal condolences at this point – and then use Kali Linux as a virtual machine. This can make sense in this setup, but I prefer to use Debian stable as operating system for penetration testing.

Now how do I learn Kali Linux?

Actually, the question how to learn Kali Linux is already wrong. Nevertheless, it is asked over and over again and haunts various forums: I want to learn Kali Linux! If you just want to try out some hacking tools (locally, on your own private network), you can simply install Kali Linux as a VM and experiment with the installed tools. But you won’t get beyond the level of experimenting. But if you really want to deal with a Linux distribution and hacking tools, you should better install Debian stable – or another reasonable distribution for daily use. Hacking is learned by being curious, not doing anything illegal or just not getting caught and gaining experience. Penetration testing is learned by building a high enough background in IT, hacking, and then learning structured procedures for penetration testing. Kali Linux is learned by downloading it, starting it as a VM, looking at the tools installed, and then realizing that it is simply a Linux distribution with tools pre-installed. Just a Debian Linux distribution with a cool reputation as a Linux distribution used by real hackers.

In the approach during a pentest – or actually in the amount and details of the information base made available to the penetration tester – three variants can be distinguished: whitebox, graybox and blackbox pentesting.

The blackbox pentest corresponds pretty closely to the information base of a typical external attacker over the Internet. He only knows the company to attack, he has to gather all the other information himself. Be it IP addresses, DNS entries, programming languages ​​​​used about job offers… the possibilities for information gathering are extensive, but also time-consuming. And thus increase the costs of a pentest in order to get the same result as with the whitebox or graybox approach.

The whitebox pentest is the opposite of the blackbox pentest: here a penetration tester is given all the information and data that he might need: documentation on the IT systems, information about configuration settings, network diagrams or even the source code of web applications by his client. A pentester quickly ends up in an information overload, which again costs time and money.

A good compromise between the whitebox and blackbox pentest is the graybox pentest. The penetration tester usually gets at least all the information here that simply saves him valuable time and that he would have found anyway. In addition, a client does not have to hand over all internal information and documentation. Typically, further information can also be obtained from the pentester by asking his client during the actual test, such as which database system is used by an application. In this way, he can carry out targeted attacks and identify all vulnerabilites in IT systems and IT applications as efficiently as possible.

A penetration tester is a professional IT security expert with a strong technical focus who, based on a structured approach, identifies vulnerabilities in IT systems and applications and exploits them if agreed by his client. As a penetration tester, he uses the same hacking tools and techniques that a malicious attacker uses.

The best Linux for beginners is Debian GNU/Linux. It is, in my opinion, the best Linux for beginners who want to learn as well as experts. It is a stable Linux distribution on which well-known other distributions such as Ubuntu or Kali Linux are based on, still Debian is not a hardcore distribution like Gentoo Linux either.

Personally, I started with Debian Sarge back when it was still testing. Now I’m still working with Debian. In the meantime I’ve tried various other distributions like Ubuntu, Linux Mint, Gentoo, SuSE, Fedora etc., but I’ve always came back to Debian.

The costs of a penetration test depend on the time spent and the daily rate of the penetration tester.

The daily rates for penetration testers are above average and range between €1,200 and €2,000, provided it is a reputable service provider for penetration tests. Lower daily rates usually indicate that the respective provider is trying to sell a vulnerability scan rather than a penetration test. Good staff with a lot of know-how and experience cost money and this is usually reflected in the daily rates.

The number of days invested mostly depends on the complexity of the scope or the system, application or company to be tested. The more complex the attack surface, the longer the check takes.

Shorter penetration tests take 2 days, larger systems can take several weeks. Usually 5-10 days is a realistic average, with deviations up and down.

Thus, the costs often start at €2,400-3,000 for a small pentest and reach the level of around €12-16,000 relatively quickly, although there are no upper limits.

A penetration test is basically a structured attack on a company’s IT infrastructure. During this, a penetration tester uses the same tools and techniques that a hacker uses in his attack. However, the objective differs between a malicious hacker and a professional penetration tester.

A hacker usually tries to hack a company in order to gain access to its IT systems and data. To do this, he only needs a single critical vulnerability that can successfully exploited.

However, companies that commission a penetration test do not primarily want to be successfully hacked, they want to know whether this is possible. For this purpose, a penetration tester will try to identify all vulnerabilities, regardless of their criticality. Many vulnerabilities are also attempted to be exploited, but not all. Because some further attacks pose a higher risk for the attacked IT systems.