U.S. Senators Ron Wyden and Marco Rubio have sent an urgent plea to new Cybersecurity and Infrastructure Security Agency (CISA), Christopher Krebs to launch an investigation into foreign-owned virtual private networks to assess whether they represent a national security threat to government.
Justin Jett, Director of Audit and Compliance at Plixer:
“Apps developed by foreign companies should be seen as risky, especially as it relates to government agencies and their employees. Because the traffic may be routed to foreign servers, it could be very difficult to subpoena the data or to understand who has access to the data. Additionally, because apps installed on mobile devices often install “profiles” that include root certificates, the apps could be written to man-in-the-middle HTTPS traffic by using TLS decryption. This happens when the app does the HTTPS handshake instead of the user’s browser. When this happens, the user’s entire interaction, including login details, is visible to the app’s developers. Government agencies and enterprises should use network traffic analytics on their networks so they can understand which, and how many, devices are using VPN services that communicate to a foreign entity. Since the VPN will route all traffic to a single location, these devices will be fairly easy to detect because they will have a single communication for all of their network traffic. Furthermore, agencies and enterprises that provide devices to employees should strongly consider policies that prevent users from installing these types of applications. Sensitive information could easily be accessed if employees aren’t careful where they send their traffic.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.