Thread by @juanandres_gs

Tbh, when I tweeted out the story about VPNs getting consolidated under a shady company with a reputation for malware/adware distribution, I didn't expect that it would get that big of a response. Since folks are interested, I wanted to discuss my biggest issue w this... #Thread

Sure, shady monetization schemes w ads are the bulk of the business model but it doesn't take into account the targeted espionage concern. Ad networks are fantastically positioned to profile internet users to an impressive level of granularity but they're limited–

For a determined adversary with control or influence over an ad network, you might have access to selectively injecting iframes or malicious ads in the hopes of hitting that one precious target. But a VPN introduces a much smoother avenue of attack.

The combo of malicious ad-network+VPN-provider means that not only can they profile specific users but they can also shape their traffic. And that's where the real magic enters the picture as 'TNI'!

'Tactical network injection', as some 'lawful intercept' companies dub it, is one of the holy grails of mid-tier state espionage. The idea is that (by being on the same network or via an appliance in attacker-controlled ISP) the attackers can trojanize executables in flight.

Scenario 1: User downloads Skype installer from the Skype website, attacker has set a rule for this, gets in the middle of that connection and keeps it alive, downloads the skype installer, trojanizes it with their backdoor, then serves the installer to the user.

Sure, the hash is wrong, the signature is either replaced or missing, but the victim got the installer they wanted from the legitimate website they visited so suspicions are low, and the target is infected.

These capabilities were developed and sold by HackingTeam and FinFisher among many others. Here's a recent example–
citizenlab.ca/2018/03/bad-tr…

The limitations of TNI solutions are obvious. A 'mobile' setup (a laptop w fancy network cards etc) is limited to proximity to a shared wifi network. The more expensive appliance requires access to a compliant ISP and that the victim be a customer of that ISP (region limited).

How would you go about using this technology for targets of interest that live somewhere else? Fly people there each time(RU)? Break into a foreign ISP with a big box(US)?...or you could own and proselytize the use of attacker VPN services in the regions you're interested in?

Think about it... it's not only cheaper, people are paying you to run this, you also make ad revenue, you can sell their data, AND.. you can occasionally serve some other shady interest by infecting some unsuspecting customer.

There's always been an expectation that this was happening, particularly with VPNs in the Middle East. How about a VPN monopoly? /rant