Mullvad tunnuksia jaossa, mutta nyt tiedon valossa on jotakin muita tunnuksia kuin varsinaisten käyttäjien ostamia tunnuksia.
Voin itsekkin tämän todistaa, kirjoitin Startpage hakukoneeseen tietyn haun, niin tuli monta sivua noita tunnuksien linkkejä, joita voi käyttää siten mahdollisesti kirjautumiseen (jos siis ylipäätänsä enää toimivat):
Mullvad CEOn vastaus (ei ole ongelma):
The company insists this is not a leak but rather accounts that were given away for free and ended up on public forums.
Recently, Damien Bancal, a security researcher with over 30 years of experience, posted a brief news report, alleging that a Swedish VPN provider, Mullvad VPN, leaked user data.
“During an investigation carried out on behalf of a client of the ZATAZ Monitoring service, an astonishing data leak targeting Mullvad was discovered. Dozens of web addresses, leading to the Mullvad API, offered access to user connection information, such as IP addresses [IPv4 and IPv6 addresses], connection dates and some other information which, fortunately, was not personally identifiable,” the post reads.
Bancal, who’s been following hackers for years now, stumbled upon a hacker discussion and learned about their plans to release some data related to the Mullvad VPN on the dark market. The hackers shared some data that included a 16-digit Mullvad client ID along with their expiration date.
The researcher shared several different links to caches of forums where threat actors apparently were trading off dozens of Mullvad VPN accounts. It seems that not a lot of information on those accounts can be exposed with just an ID number, as no names, email addresses or other personally identifiable information can be retrieved.
Voin itsekkin tämän todistaa, kirjoitin Startpage hakukoneeseen tietyn haun, niin tuli monta sivua noita tunnuksien linkkejä, joita voi käyttää siten mahdollisesti kirjautumiseen (jos siis ylipäätänsä enää toimivat):
Mullvad CEOn vastaus (ei ole ongelma):
Jan Jonsson, CEO of Mullvad VPN, wasn’t surprised to hear about the publicly exposed accounts. He said he’d personally seen pages with over 100 Mullvad VPN accounts.
“Wayback Machine indexes most of the web-sites and forums on the internet.mThere are many forums and pages that list “leaked” Mullvad accounts. Since Mullvad donates hundreds of thousands of Mullvad accounts yearly, for various reasons, to various organizations – these accounts end up at such forums/websites. This is one of several sources for “leaked accounts,” he told Cybernews via email.
He emphasized that this was not a leak. “Firstly, we do have an API with very limited functions. There is no personal information on an account, such as passwords. We do not even use passwords, a user generates just a 16 digit account number.”
According to him, people are trying to brute-force accounts – guessing account numbers in order to get a free account to use. Jonsson went on explaining: “An account number is a 16-digit decimal number in the range "1000 0000 0000 0000" to "9999 9999 9999 9999". There are 9*10¹⁵ different possible accounts (“9000 0000 0000 0000”). If for example we have 1 million paying customers, the chance to guess one is 1*10⁶ / 9*10¹⁵ You have to guess 1.11*10¹⁰ times to find one. Guessing 100 times per second, it will take 1.11*10⁸ seconds to find one paying account= 30833 hours = 1285 days. We have protection in place with strict rate limits, which means we do not allow anyone to guess 100 times per second.”
Viimeksi muokattu: