Hola VPN turns 10M users into exit nodes

by ivank • 11 years ago

296 112 11 years ago

bifrost3• 11 years ago

This is basically why you never want to use a proprietary client with any VPN service, you don't know what you're getting into at all. At least with PPtP/L2TP/OpenVPN based services you can use well known clients or OS vendor provided clients that are unlikely to have little goodies like this.

NeutronBoy• 11 years ago

Hola explicitly say this is why they're able to offer the service for free http://hola.org/faq#in_how_is_free

dchuk beat me to it!

Moru• 11 years ago

Yes, now it says so. Didn't do that earlier :-)

voltagex_• 11 years ago

I'm not sure this will get seen but - is there an OpenVPN client for Windows that doesn't suck?

imsofuture• 11 years ago

Viscosity is pretty good for Macs+Windows.

webdigi• 11 years ago

Never use proprietary clients if possible. Also on the VPN server side, you could investigate the option to create your own VPN server in a few minutes https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-pr...

tiatia• 11 years ago

Good luck with that in China mate!

dchuk3• 11 years ago

They explicitly state in their FAQ how this works and why their service is able to be free: http://hola.org/faq#in_how_is_free

They even have a non-free option that eliminates the VPN as a proxy feature.

"Hola built a peer to peer overlay network for HTTP, which securely routes the sites you choose through other Hola users' devices and not through expensive servers. Hola never takes up valuable resources from these users, since it only uses a user as a proxy if that users' device is completely idle (meaning device is connected to electric power (not on battery), no mouse or keyboard activity is detected, and device is connected to the local network or Wifi (not on cellular)). This makes Hola the first VPN service without underlying operational costs. Although Hola doesn�t need to pay for bandwidth, we still need to pay the engineers who create, maintain and keep improving the free Hola service. Hola generates revenue by selling a commercial version of the Hola VPN service to businesses (through our Luminati brand). This is what allows us to keep Hola free for our users. Users who want to enjoy the Hola network without contributing their idle resources can do so by joining the Hola premium service for $5 per month (or $45 per year)."

sergiotapia• 11 years ago

And that somehow makes what they're doing OK?

dchuk3• 11 years ago

I'm not sure I understand your logic here. They've come up with a clever way to create a sustainable, free vpn service, with the ability to easily opt-out for a still reasonable price. All the while clearly stating how it all works in their FAQ.

What more do you want them to do?

8chan5• 11 years ago

Hello, Fredrick Brennan here (8chan owner).

They changed their FAQ IN RESPONSE to my breaking the story on this.

Proof:

Google cache of Hola FAQ as of 26 May: https://archive.is/tgujS

As you can see, there is no mention of Luminati, or the underlying mechanics at all.

I published hola.html and updated my global announcement just hours before the FAQ change: https://twitter.com/infinitechan/status/603178141650026498

There are millions of users who installed this and do not know how it works. Please do not downplay this issue.

sudioStudio643• 11 years ago

It looks like they clarified their story, not changed it? It did say that it uses idle resources collaboratively...I'm not really trying to argue, just wondering if it was really that deceptive. I had never heard of them until this post.

8chan5• 11 years ago

Also, Luminati was falsely claiming that they were more anonymous than Tor before I did some digging. They changed that too: https://twitter.com/infinitechan/status/603512756331913216

Shady business all around.

zxcvcxz• 11 years ago

I see this Hola thing get upvoted all the time on reddit as a way to watch region-locked videos. Pretty disgusting that they've tricked millions into installing their software without informing them of all the illegal activities that could be funnled through their IP.

yohui• 11 years ago

The Luminati angle is new, but the fact that free Hola users are used as peers or exit nodes is common knowledge among better informed users. I've warned others of that fact in the past myself.

Of course, I imagine most users are not so well informed.

stevenh• 11 years ago

Even if they had said it all along in their FAQ, it's still infuriatingly disingenuous for someone to act as if anyone ever browses to Hola's site and reads their FAQ either before or after installing the Hola malware extension. No ordinary person will ever do this.

What happens is that someone who has already installed Hola, and who is ignorant by design as to what the extension actually does, tells a friend about Hola; the friend installs it, sees the expected functionality, is unaware of the malicious functionality, and the pyramid of ignorance continues to grow after he tells his own friends about how great Hola is.

These few sentences written in the sidebar here [1] are all that at least 7,102,584 of Hola's victims ever saw (judging by the install count for this malicious Chrome extension):

Access websites blocked in your country, company or school with Hola! Hola is free and easy to use!

FREE and secure VPN. Access websites blocked or censored in your country, company or school and stream media with the free Hola Unblocker VPN proxy service.

Hola is a free and ad-free VPN proxy service that provides a faster and more open Internet.

At no point do they attempt to make it clear in the slightest that they turn your browser into a for-profit bot net node, nor that your own browser becomes a proxy for others. In all venues where Hola expects 99.9% of interested parties to see their product pitch, they intentionally convey the false impression that they personally own their own VPN proxy backends.

Aside from all of that, hiding an explanation of your malware's behavior in the FAQ on some website no one ever sees doesn't suddenly transform it into normal, respectable software. Malware is malware, and bot nets are bot nets.

This is yet another criminal enterprise allowed to flourish and fester simply because Google refuses to police browser extensions in the Chrome web store.

Google runs what I assume must be the largest de facto Universal XSS exploit breeding ground in the world (Chrome extensions in the Chrome web store), and yet they refuse to police its contents.

Here's a recent example. I run AdSense on my site, and it kept running the same ad for an atrocious web game that a 10 year old could have made as their first programming project. I eventually saw the exact same ad running on another site, so I clicked it there in order to avoid the absurd rule that clicking ads on your own site gets you banned from AdSense. (Why don't they just silently discard those clicks, since they know they are from the publisher?) Clicking the ad took me to a page which did not have a game at all; it just falsely claimed you could play a game if you installed their malware browser extension, which it immediately prompted me to install [2]. The extension actually has nothing whatsoever to do with games. It doesn't enable you to play a game at all, anywhere. All it does is replace ads across the entire web with ads from its own ad network for the remainder of the lifetime of that computer. The extension has millions of installs and probably causes Google to lose seven figures per year in AdSense revenue due to so many AdSense ads being replaced with ads from another network. I also think it's funny that ads were being run on my site for the specific purpose of installing malware that would replace the ads and destroy the ad revenue for the very same site that helped it get installed in the first place. I reported this extension three times using the official report forms for the directly relevant teams at Google (even explaining in detail how it damages their own AdSense platform, so unlike a typical consumer complaint, this was actually affecting their profits and they should listen for once), and I was consistently ignored.

1. https://chrome.google.com/webstore/detail/hola-better-intern...

2. http://i.imgur.com/8JJVjZ2.png

makeitsuckless• 11 years ago

Not do downplay this issue, but wouldn't one simply assume it works this way.

I mean, how else would it work, Hola operating their own proxies and giving all of that infrastructure and bandwidth away for free?

Of course it would be P2P and would turn the user into a supplier of data and bandwidth to others. This basic model has been in use for "illegal" content for well over a decade now.

Now how they exploit that bandwidth is a different matter. Conflating those two is what will give you the "meh" reaction.

Also, "accusing" Hola of being unethical because it has no recognizable signature is another red herring. Of course it hasn't, otherwise it would get blocked by the geotarded services it is supposed to unblock. It's not an evil feature in itself.

The Luminati exploitation angle is the issue. Everything else about Hola is either transparant or at least pretty damn obvious.

logn2• 11 years ago

As you can see, there is no mention of Luminati, or the underlying mechanics at all.

They didn't write "Luminati" but they wrote this:

"Hola and Hola premium are free for private, non-commercial use. For a commercial license to Hola please contact [...]. Your commercial license will provide you with these additional features: Hola For business: License to use Hola for commercial purposes. Automation: developer API that enable controlling the routing of your HTTP requests via software. Allow many concurrent sessions. High bandwidth/high request rate with multiple IPs. More precise resolution of exit node IP. Faster changing of IP. Engineering technical support."

"Typical VPNs need to maintain servers in various countries and to route your traffic through those servers in order to change your IP. This is very expensive. Hola is a network of peers that help each other to access sites, thereby eliminating the need for servers, and thus operating without costs."

bruce487• 11 years ago

Out of interest: Do other vpns work the same way? Even if it's clearly stated in the FAQ, not everybody reads them.

albertoleal• 11 years ago

Anyone have VPN recommendations?

mbubb• 11 years ago

This company looks interesting - https://www.tunnlr.com/ I learned about them from http://devio.us/ (which is great when it works...)

I did the trial for 1 day and tried them out. Have no pressing reason to continue for now but have filed them in the mental rolodex.

nyolfen• 11 years ago

i've been renting a cheap-as-dirt vps ($15/yr) and just using sshuttle[0] to proxy through it which works great for my circumstances (my school blocks nonstandard ports but is just dandy with 22)

[0] https://github.com/apenwarr/sshuttle

yc1010• 11 years ago

You could also setup tinyproxy (https://banu.com/tinyproxy/) to proxy http/https via your linux VPS (and limit connections to only your ip)

even better just run socks5 thru ssh http://straightedgelinux.com/blog/howto/socks.html

Tho I recommend using autossh to maintain the ssh tunnel which could be flaky at times

http://www.debianadmin.com/autossh-automatically-restart-ssh...

mverwijs• 11 years ago

And just in case you're in a network that does block access to port 22, use sslh to listen to port 443 and map all ssh traffic to port 22 (and all https traffic to httpd, and all openvpn traffic to 1194).

One port (443) to rule them all!

asquabventured2• 11 years ago

https://www.privateinternetaccess.com/ (PIA) works for me. Of course with any VPN you run the risk of providing all of your information through a (potentially) captured source.

bifrost3• 11 years ago

I usually point people to this: http://torrentfreak.com/anonymous-vpn-service-provider-revie...

As a former privacy VPN operator I can tell you its extremely hard to operate one securely.

asquabventured2• 11 years ago

There is no such thing as total security, there is only what we know and then what we do not know.

shawkinaw• 11 years ago

Roll your own: https://www.digitalocean.com/community/tutorials/how-to-setu...

theGimp• 11 years ago

That works if you want to pretend you're from a different country.

It doesn't work if you want to anonymize yourself.

tonyhb3• 11 years ago

Please do not ever use PPTP — it has been broken for years. Instead use OpenVPN.

https://security.stackexchange.com/questions/47518/is-pptp-v...

mingabunga• 11 years ago

HideAway: Uses rules so can be always on http://www.firetrust.com/en/products/hideaway

okbake• 11 years ago

I use NordVPN, which I have no complaints about. But occasionally I'll get a 1 week token from cryptostorm (https://cryptostorm.is/)

They have an interesting model: you buy a token that expires after a certain length of time (1 week, 1 month, 1 year, etc). The clock doesn't start ticking until the first time you log in. Instead of registering a username/password, you're sent the token via email and your login ends up being a sha512 hash of the token for the username. There is no password associated, just the hash of the token is all you need.

I like this because you're able to buy 'disposable' accounts basically. They take bitcoin and some alt coins too, which is nice. Dns protection and access to .onion and .bit domains. It all seems pretty solid. NordVPN tends to be a little bit faster for me, though it may depend on which servers you use.

khnd• 11 years ago

tunnelbear

developer1• 11 years ago

For technically inclined people, setting up your own SOCKS proxy is the simplest method possible.

1. Get a cheap server (ex: DigitalOcean $5/month) in the city/country you want to connect through.

2. Add these 2 lines to /etc/ssh/sshd_config:

AllowTcpForwarding yes

GatewayPorts yes

3. Restart sshd (service ssh restart), or restart the server.

4. Connect to the server setting a dynamic port forward. On linux or Mac, this is just "ssh -D 8000 user@domain.com". On Windows, putty lets you set a dynamic port forward.

5. Personally I use Chrome for my real browsing, and then use Firefox for the proxy since it allows configuring a proxy for the browser only rather than the entire operating system. You just set the SOCKS proxy under advanced networking settings (host 127.0.0.1, port 8000).

6. If you want all internet traffic to go over the proxy rather than just Firefox, this is easy on Mac through the Network Preferences panel. I'm not able to comment on linux/Windows in this regard.

mahouse• 11 years ago

As far as I know, that leads to terrible performance.

ultramancool3• 11 years ago

A few extra things to add:

1) If you want everything, UDP data, non-SOCKS supporting apps, etc to go through, you're better off configuring an OpenVPN server. It takes some extra effort, but this allows it to work easily on mobile platforms and stuff too.

2) If you want to use this from a restricted network, use port 443 (for OpenVPN or SSH).

3) If your network is extremely strict, use stunnel to make it look exactly like standard SSL web traffic. I've written a helper app for people who need this on Android, https://github.com/ultramancool/Stunneler

Gladdyu• 11 years ago

I doubt that if they sell their users as bots they will do anything about the network being used as a botnet and there is nothing you can do about it, especially considering the users 'responsible' won't even know what they are taking part in.

ars• 11 years ago

It's not clear that part of the article is even true.

They appear to just sell VPN server by the GB. I see nothing about a botnet in there, there is no traffic amplification or ability to run programs on the clients.

cekanoni2• 11 years ago

you obviously don't understand this :)

yellowapple2• 11 years ago

The point of that bit is that it's not only possible, but borderline-trivial, for a malicious application (e.g. spambot, DDoSbot, etc.) to hook into the API and flood a target using Hola users as endpoints; the article states that such an incident has already happened, and that 24-hour captchas have been instituted for all users as a result in an attempt to stifle future such attacks on 8chan.

batuhanicoz2• 11 years ago

Anyone knows a better alternative to luminati.io? We've been using it in our company but it feels expensive.

I thought this thread may be good place to ask for an alternative.

Scoundreller• 11 years ago

We've been using it in our company but it feels expensive.

I just looked up the cost and no kidding at $20/GB.

tonyhb3• 11 years ago

Spin up VPS instances across multiple cities, countries and continents.

Hook them up with Docker and connect them with Swarm.

Label them with an IP/city/country/continent combination.

Use Docker Swarm's affinity labelling to start instances in a particular city when needed. Additionally record the last IPs used and use Swarm to not deploy to those servers.

batuhanicoz2• 11 years ago

We scrape more than 120,000 web pages per day.

Cost of spinning up VPS instances, maintaining the software needed (to automatically close/open new ones and provision them) could be higher than the 20$/GB pricing Luminati offers.

predius• 11 years ago

I work for Scrapinghub which has a Proxy API which may work for you: http://scrapinghub.com/crawlera

Pricing is a lot less and we only use our own IPs.

cekanoni2• 11 years ago

that's sneaky and some one needs to point out for this!

eyeareque• 11 years ago

This made me laugh--I wonder how many innocent people are going to have the FBI kick their doors down for things that past through their "exit nodes" that they hosted.

stefantalpalaru2• 11 years ago

Let's hope there's safety in numbers.

yaeger• 11 years ago

Judging by in what context I have read about Hola so far, I guess the biggest use case is to circumvent geo block to access things like Netflix. But yeah, ever since I learned that I am acting as an exit node for others I have stopped using the service as I do not want to be the one answering for stuff others have done in my name(IP).

anc84• 11 years ago

I wish it was the other way around, mass-spread sharing of internet access leading to it becoming the norm and people finally getting some privacy from mixing their connections.

tombozi2• 11 years ago

What if a node messes with the response and returns fake data? Do they route the request over multiple nodes and compare the results? Then what if someone owns a lot of nodes?

8chan5• 11 years ago

Hola's browser extension is proprietary. A friend of mine has been considering reverse engineering it but is not sure of the laws.

tombozi2• 11 years ago

I assume they forward the requests to their own servers? In that case there isn't much to reverse engineer without access to their servers. Unless they use some kind of P2P system, which I doubt.

milankragujevic4• 11 years ago

I've reverse engineered it a long time ago and are using their proxy clients (ZAgents as they refer to them internally) as proxies for clicking on my own ads. I have their username and password and a list of dyndns domains. Email me if you want the data.

kuschku2• 11 years ago

If they are in the EU – great, the right to learn covers the right to take apart, understand, reassemble, and remix any technology that you have a license to use and where, during the process, the original owner has no material losses.

So, if he’s in the EU, he can do it. (IANAL, but this was the conclusio of an EUGH decision). Otherwise it gets harder.

userbinator• 11 years ago

So far as I can tell, there is no way to tell if an IP has the Hola VPN software installed or not: no tell tale open port, no special header from Luminati, and no specific range.

Then, immediately in the next paragraph:

An attacker used the Luminati network to send thousands of legitimate-looking POST requests to 8chan's post.php in 30 seconds, representing a 100x spike over peak traffic and crashing PHP-FPM.

How was that conclusion arrived at? Am I missing something here?

theralphretort• 11 years ago

"Ah, the user flooding himself (Bui) spilled the beans and told me how he did it voluntarily in IRC. Otherwise I'd have no clue." -Fredrick Brennan (8chan)

darkengine• 11 years ago

Copypaste is rate limited, he had this to say: https://twitter.com/HW_BEAT_THAT/status/603741442490642432

"The user flooding himself (Bui) spilled the beans and told me how he did it voluntarily in IRC. Otherwise I'd have no clue."

alexbecker• 11 years ago

One way to find out (not saying this is how it was done) would be to spin up a machine running Hola and see where the traffic goes.

ajdlinux2• 11 years ago

Anyone like to recommend a browser-extension-based VPN tool that's a bit more respectful than Hola and is relatively cheap?

(Of course I run my own VPN server using OpenVPN, but Hola is really convenient when I'm only trying to get an American IP to avoid Australian geoblocking - it's also easy for non-technical friends to use.)

joelkesler• 11 years ago

Tunnelbear recently released a chrome plugin for their VPN service. I hear good things about it. (I personally use the application on my Mac)

DonGateley2• 11 years ago

Tunnlebear makes no claims relative to logging its users activities or about its responsiveness to requests for them. Beware.

hiamnew2• 11 years ago

Just use Tor Browser, it's "extract and launch".

ajdlinux2• 11 years ago

Tor Browser is great, but I'm not going to use it for watching video, which is all I ever use a VPN to do...

addandsubtract• 11 years ago

Try https://zenmate.com/

milankragujevic4• 11 years ago

If anyone cares for their proxy links, here are they: http://milankragujevic.com/uploads/hola/?ref=hackernews And the blog post: http://milankragujevic.com/post.php?id=72&ref=hackernews&cid...

prawnsalad3• 11 years ago

I had also broken down the way this works a long while ago and found they have a lot more proxies than this. In some cases they just have a digitalocean VPS running somewhere to help beef up the network.

It was only recently that they started requiring the user auth for the proxy access, earlier it was a free for all without any auth at all. Now they have the option to track which accounts are causing traffic on their network and potentially put a stop to them (not that is isn't difficult to get around)

milankragujevic4• 11 years ago

Yes, you can enumerate the number of proxies from 1 to 999 with a while(true) loop. However I just used their own api for this.

imron• 11 years ago

or allows domains to pay them off for such a rejection.

Thereby creating the world's largest extortion racket.

Yeah, maybe not such a good idea to encourage that sort of business model.

CRR1• 11 years ago

no need to uninstall.

signup for a new account via this link and you get free premium which means you are off the exit node list

http://hola.org/referral_signup?referrer_uid=basic%2Fg163589...

re-signup each month for a new account and a new month of premium

Hola VPN turns 10M users into exit nodes

Related Stories