Is your VPN trustworthy

Barcelona School of Informatics Bachelor’s degree in Informatics Engineering Bachelor’s Thesis Is Your VPN Trustworthy Author Ismael de la Garcia Cobos Advisors Pere Barlet Ros Ismael Castell Q1 2020/2021 Is Your VPN Trustworthy Abstract Nowadays people are more and more concerned about their privacy and safety on the internet. Also, being public as it is, some content is limited based on geolocation. On the other hand, remote work is also becoming a matter of fact. These things have empowered the use of Virtual Private Networks. However, it is well known that VPNs, if malicious, can steal all your personal information. In this paper we want to build a tool that can analyze and detect any malicious traffic in your VPN. Resumen Cada día la privacidad y la seguridad en internet es un tema que preocupa a más personas. Además, y a pesar de ser público, hay contenido que se limita dependiendo de la localización. Por otro lado, el trabajo en remoto está cada vez más a la orden del día. Todo esto ha hecho que crezca el uso de las Virtual Private Networks. Es bien sabido que una VPN con malas intenciones puede llegar a robar toda tu información personal y privarte de la privacidad. En este trabajo se pretende crear una herramienta que permita detectar trafico malicioso en un cliente VPN. Resum Cada dia la privacitat i la seguretat a internet és un tema que preocupa a més persones. A més, i tot i ser públic, hi ha contingut que es limita depenent de la localització. D’altra banda, el treball en remot està cada vegada més a l’ordre del dia. Tot això ha fet que creixi l’ús de les Virtual Private Networks. És ben sabut que una VPN amb males intencions pot arribar a robar tota la teva informació personal i privar-te de la privacitat. En aquest treball es pretén crear una eina que permeti detectar trànsit maliciós en un client VPN. 1 Is your VPN trustworthy Acknowledgments I would first like to thank my thesis advisors Pere Barlet and Ismael Castell at Politechnics University of Catalonia, due to his instant e-mail answers when I ran into a trouble spot or had a question about my research or writing. They consistently allowed this thesis to be my own work, but guided me in the right direction whenever They thought I needed it. Both of them arranged periodic meetings with me and other students to share our findings and find a solution to our problems together. Finally, I must express my very profound gratitude to my parents for providing me with unfailing support and continuous encouragement throughout my years of study and through the process of researching and writing this thesis. This accomplishment would not have been possible without them. Thank you all who have helped in one way or another to make this project possible. 2 Is Your VPN Trustworthy Revision history and approval record Version Date Description 0 28/09/2020 Document creation 1 10/10/2020 Update. Corrections suggested by the teacher in delivery 1 - Project Scope. 2 12/10/2020 Update. Corrections suggested by the teacher in delivery 2 - Project Planning. 3 16/10/2020 Update. Corrections suggested by the teacher in delivery 3 - Economic Analysis. 4 12/01/2021 Update. Added planning adjustements. 5 14/04/2022 Update. State of the art and project description created. Initial results commented. 6 22/04/2022 Update. Adjusted figures, tables and conclusions to the last findings. Table 1: Record of modifications made to this document 3 Is your VPN trustworthy List of Figures 1.1 VPN diagram. Source: Original . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.1 Git-flow example. Source: Atlassian.com . . . . . . . . . . . . . . . . . . . . . . 20 4.1 Backlog of the user stories of the project. Source: Original. . . . . . . . . . . . . 22 4.2 Gantt chart of the user stories. Source: Original. . . . . . . . . . . . . . . . . . . 23 4.3 Tasks of the project (One). Source: Original. . . . . . . . . . . . . . . . . . . . . 25 4.4 Tasks of the project (Two). Source: Original. . . . . . . . . . . . . . . . . . . . . 26 5.1 Cost table. Part 1. Source: Original. . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.2 Cost table. Part 2. Source: Original. . . . . . . . . . . . . . . . . . . . . . . . . . 31 5.3 Control template for each developer. Source: Original. . . . . . . . . . . . . . . . 32 8.1 Crawler behaviour diagram. Source: Original. . . . . . . . . . . . . . . . . . . . . 46 8.2 Crawler Domain UML. Source: Original. . . . . . . . . . . . . . . . . . . . . . . . 46 8.3 Data Processor behaviour diagram. Source: Original. . . . . . . . . . . . . . . . . 48 8.4 Data Processor Domain UML. Source: Original. . . . . . . . . . . . . . . . . . . 49 9.1 Common resources found in all runs of pages (One). Source: Original. . . . . . . 53 9.2 Common resources found in all runs of pages (Two). Source: Original. . . . . . . 54 9.3 Example 1. On top, page visited with no VPN extension. At the bottom, page visited with Hola VPN. Source: Original. . . . . . . . . . . . . . . . . . . . . . . 56 9.4 Example 2. On top, page visited with no VPN extension. At the bottom, page visited with Hola VPN. Source: Original. . . . . . . . . . . . . . . . . . . . . . . 57 9.5 Example 1. On top, page visited with no VPN extension. At the bottom, page visited with Hotspot VPN. Source: Original. . . . . . . . . . . . . . . . . . . . . 59 4 Is Your VPN Trustworthy 9.6 Example 2. On top, page visited with no VPN extension. At the bottom, page visited with Hotspot VPN. Source: Original. . . . . . . . . . . . . . . . . . . . . 60 11.1 Cookie syncing diagram. Source: Amazon.com . . . . . . . . . . . . . . . . . . . 73 5 Is your VPN trustworthy List of Tables 1 Record of modifications made to this document . . . . . . . . . . . . . . . . . . . 3 7.1 Firmware that support VPNs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 7.2 FreeVPNexamples. .................................. 39 7.3 PaidVPNexamples................................... 39 7.4 Browser add-on examples and the data they collect. . . . . . . . . . . . . . . . . 41 7.5 Examples of Proxy extensions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 8.1 Web pages visited with crawler. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 8.2 Extensions analyzed in the project . . . . . . . . . . . . . . . . . . . . . . . . . . 45 6 Is your VPN trustworthy Table of contents 1 Introduction 12 1.1 Justification....................................... 13 2 Project scope 15 2.1 Objectives........................................ 15 2.2 Requirements and specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2.1 Functional Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2.2 Non-Functional Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.3 Actors.......................................... 16 2.4 Obstaclesandrisks................................... 17 3 Methodology 19 3.1 Tools........................................... 19 3.1.1 Git........................................ 19 3.1.2 Github...................................... 19 3.1.3 Git-flow..................................... 19 3.1.4 Taiga ...................................... 20 3.1.5 Slack....................................... 20 3.1.6 BeautifierOnline................................ 20 4 Project planning 21 4.1 Riskmanagement.................................... 24 4.1.1 JSInjection................................... 24 4.1.2 TLSInterception................................ 27 7 Is Your VPN Trustworthy 5 Sustainability and budget 28 5.1 Environmental ..................................... 28 5.2 Economic ........................................ 29 5.2.1 Control ..................................... 32 5.3 Social .......................................... 32 6 Planning adjustments 34 7 State of the Art 35 7.1 VPNs .......................................... 35 7.1.1 Where can VPNs be installed . . . . . . . . . . . . . . . . . . . . . . . . . 35 7.1.2 Aretheyanonymous? ............................. 36 7.1.3 FreeorPaidVPNs............................... 38 7.1.4 What does a VPN hide? . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 7.2 Browseradd-on..................................... 40 7.2.1 Whatcantheydo?............................... 40 7.3 VPNExtensions .................................... 41 7.3.1 What are the advantages of a VPN extension? . . . . . . . . . . . . . . . 41 7.3.2 Kinds of proxy extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 8 Description of the project 43 8.1 DataCrawler...................................... 44 8.1.1 Howdoesitwork? ............................... 44 8.1.2 Structure .................................... 46 8.2 DataProcessor ..................................... 46 8.2.1 Howdoesitwork? ............................... 47 8.2.2 Structure .................................... 47 8.3 Technologies....................................... 47 8.3.1 Crawling .................................... 50 8.3.2 Dataprocessing................................. 50 9 Final results 51 9.1 MetadataAnalysis ................................... 51 9.2 HolaVPN........................................ 52 8 Is your VPN trustworthy 2. Project scope A new way of working is approaching due to the recent changes in the world. Remote work has become a necessity in countries which were not ready for it. On the other hand, our privacy is threatened every day to a point most people can not understand. That is why many companies take advantage of this situation to make money out of it. It is widely spread that VPNs, specially the free versions, offer less than paid services. Many people state that free services may also sell the users privacy online to third party companies while saying they offer increased privacy and security. Given this situation, I found the need of a tool that can protect users from malicious traffic by their VPN providers on a daily basis. Honesty should be the key to any agreement, even when using free software. Therefore, in this paper I want to propose a tool that can detect malicious traffic in a VPN client, specially the kind of traffic that may compromise the user’s privacy. 2.1 Objectives The main objectives of this project are: •Learn tracking methods VPN clients can use. •Learn to detect the VPN-related tracking methods. •Create a tool that can detect VPNs that use this tracking methods. From these, the following sub-objectives arise: •Learn about online privacy and how VPN clients can help their users improve it. •Learn about the most common tracking methods, specially those affected by VPNs. 15 Is Your VPN Trustworthy •Learn about networking and traffic analysis. •Learn how the different OS treat traffic. 2.2 Requirements and specifications The requirements of the project come from the need of portability of this tool, for users of VPNs may use very different environments. 2.2.1 Functional Requirements •It must not depend on other tools, like web browsers. •It must never modify the users traffic in any means. •It must be easily auditable. 2.2.2 Non-Functional Requirements •The tool must be user-friendly and every user should be able to use it. •It must be open-source. •It must not slow down the connection more than a 10%. •It must be easy to update. •The tool must work in the main OS (Windows, Linux, Mac). •It must work with, at least, the top 5 VPN clients according to number of users. 2.3 Actors In this section I will list the stakeholders of this thesis, be them people who will benefit, be affected partake of it. •Developer: The project will have a single developer, Ismael de la Gracia Cobos, as part of his bachelor’s degree. He will research on the topics required, develop, test and document the project. 16 Is Your VPN Trustworthy •Advisors: They will guide the developer in the project. The main advisors are Pere Barlet and Ismael Castell, a teacher in charge of many projects related to internet privacy and a doctorate student on internet privacy respectively. •VPN Providers: VPN providers will definitely be affected by this project, for their services may become compromised after the development of the proposed tool. Any VPN provider conducting privacy-abusing practices may be exposed by this tool. However, all those who do not perform wrong practices will receive the support of a third party tool in their claims for privacy and security. •Advertising companies: Every VPN that implements tracking in their clients later sells that information to an advertising company. The development of a tool that detects this interaction will surely punish this type of relations. •IT Departments: Most companies now a days have an IT department that takes care of the installation of the necessary infrastructure for the company to work. These departments may benefit out this tool in auditing their systems for security, for they will be able to know if they are using real private networks. •Tech-savvy users: This kind of users usually care about their privacy when connected to the internet. Most at times, they use VPNs to access restricted content or to navigate the internet privately. They may also wonder to what extent they are doing so. This tool will surely be interesting to them. 2.4 Obstacles and risks Throughout the project, we may encounter unexpected obstacles and risks that we will need to affront. Here we put some examples: •Implementation errors: Sadly, it is very common that developers make mistakes, for we are all humans. Debugging the type of tool we want to create may be hard, for it works at a very low level and the developer, Ismael de la Gracia, has no previous experience in this field. •Delays: No room for distraction. The project has to progress carefully to arrive on time to the deadline. If we delay on something, we can cause the delay of the other projects. 17 Is Your VPN Trustworthy •Misconceptions: Since the developer has no experience in this field and all the knowledge has just been acquired by self investigation, there might be some misconceptions that may lead to poor decisions. Therefore, it is important to investigate properly and to trust in the guidance of the advisors. •Bad documentation: Trying to understand how a project is done is a waste of time if it does not have good documentation. It is important to document every progress and change we make to the project. 18 Is your VPN trustworthy 3. Methodology The development of the project will be done using the Agile methodology, specifically Scrum [32]. Scrum is an iterative and incremental methodology, in such a way that a number of short iterations (sprints) of between 1 and 3 weeks are defined, and in each iteration value is added to the final product. This methodology divides the team into different roles. However, since there is only one developer in this project, he will carry all the tasks. In a Scrum project, a board must initially be filled ( backlog) with the user stories punctuated according to the difficulty of each, and each sprint is assigned some of these user stories that will be divided between the team of developers, and must be completed in the end of the sprint. To make it easier to develop following this Scrum methodology, several tools will be used. 3.1 Tools 3.1.1 Git Git [14] is a free and open source version control system. It is widely used in software development in cooperative projects to perform version management, through repositories and branches. 3.1.2 Github GitHub [1] is a free software Git repository manager that also has other features such as error control, and continuous integration. 3.1.3 Git-flow The Git-flow methodology [11] consists of a always stable Master Master branch, a Development branch, and Release and Feature branches. The git-flow methodology proposes that for each user history that is implemented, a new branch of Feature is created with origin in the 19 Is Your VPN Trustworthy Figure 3.1: Git-flow example. Source: Atlassian.com branch of Development, and that once this user history was complete the header is developed in Development. Figure 3.1 shows an example. 3.1.4 Taiga Taiga [20] is a free and open source project management system. It has features to create and rate user stories, to manage the backlog, and to track issues. 3.1.5 Slack "Connect your conversations with the tools and services that you use to get the job done. With over 2,000 apps and a robust API, the Slack [36] platform team works with partners and developers globally to build apps and integrations that streamline your work, automate mundane tasks and bring context into your conversations in Slack". We will use this tool to comunicate with the rest of the students and with the advisors. 3.1.6 Beautifier Online "Beautify, unpack or deobfuscate JavaScript and HTML, make JSON/JSONP readable, etc. All of the source code is completely free and open, available on GitHub under MIT licence, and we have a command-line version, python library and a node package as well." We use this tool to make legible all the resources downloaded by the crawler [5]. 20 Is your VPN trustworthy 4. Project planning As mentioned in the methodology of this project, the planning of the later has been performed and monitored using a tool called Taiga (refer to 3.1.4). You may find all the planning in the following sections. The planning in Taiga and the one explained here may differ, for the tool gives me the ability to change every part of the planning whenever needed. Since the project will follow an agile methodology, that is the best approach. However, in this section I will describe the planning of the project when it started. Before the first sprint of the project, a backlog was created with the following user stories: We consider that each story point translates to 1 hour of work. User stories have a risk potential, that is a certain degree of not going as planned, depending on: difficulty level, experience on the topic of the assigned user and unexpected events. I have classified user stories risk level using three levels: low, medium, high. I will consider that user stories may have an increase in their points of the following percentages according to their risk: 10, 50 and 100. Each user story of the backlog was assigned to a different sprint. Sprints last 1 week. Therefore, the Gantt graph of the project looks like the following: 21 Is Your VPN Trustworthy Figure 4.1: Backlog of the user stories of the project. Source: Original. 22 Is Your VPN Trustworthy Figure 4.2: Gantt chart of the user stories. Source: Original. 23 Is Your VPN Trustworthy Each user story has one or more tasks associated to it. When all tasks of a certain user story are closed, we consider the user story finished. Each task holds a percentage of the user story points. Find below the list of tasks and the user stories they are associated with: 4.1 Risk management Most of the tasks have a low level of risk in the project tracking. This means their level of complexity may vary to the one assigned by the manager, but the task doesn’t present any major threat. However, the tasks that have a medium or high level of complexity may create important challenges in the development of this project. Therefore, a backup plan has been studied in case these user stories do not develop as planned. 4.1.1 JS Injection This task presents a threat to the development of the project because not the project manager nor the developer have experience in this field. Therefore, the user story can be more challenging than expected. This part of the challenge is contemplated by the 50% risk points assigned to the task. However, another two challenges are present. Since the solution the project wants to implement must work at network level, the challenge of analyzing a web page at network level arises. Most of the flows we will analyze are encrypted. Therefore, this task may not be possible at network level. In this case, it will be necessary to study the possibility of the tool working at two different levels, network level and application level. This would mean an increase of the risk of the task 15 Implement solution to high, for difficulty reasons, which means another 20 user-story points would be added to the project. This does not represent a big problem to the development of the project for tasks have been planned according to the risks planned, and, specially the last part of the project has an inferior workload and risk, therefore this task would be performed through sprints 10 and 11 instead of 11 only. The later challenge is the performance of the tool. Analyzing every web page looking for JS Injection may be a resource consuming task, and may threat the maximum 10% slow-down allowed mentioned in the project requirements. If this is the case, and the algorithm can not be further optimized, an option will be added to the tool so that this functionality can be enabled and disabled at will, with the proper warning regarding slow-down issues. This is done this way because this project values privacy over other things, and I believe users interested in it will do 24 Is Your VPN Trustworthy Figure 5.2: Cost table. Part 2. Source: Original. 31 Is Your VPN Trustworthy Figure 5.3: Control template for each developer. Source: Original. 5.2.1 Control Each user involved in the development of the project will be asked to fill table like the one in 5.3 for each task he develops. This will greatly help to control the expected budget and the real expenses on a task basis (less than a week). It will also help to know which members are doing a great job and which need some readjustments, be them in terms of tasks assigned, workspace or any other kind. The comments column is meant to justify the differences between the expected values and the real ones. With that, the project manager will be able to discern what to do in each specific situation, if any action is required. All of this tables will be delivered in a sheet to the project manager at the end of the task. He will include them in another sheet that, based on the price per hour of the worker assigned, will calculate the total costs and deviations. When required, he will check the specific comments and justification in each task to know how to proceed. 5.3 Social Personally, I think this project will contribute to me and anyone who partakes or uses it by giving better insight and understanding of what internet privacy means. Until now, there has been a lot of interest into that topic, and most users know well the dangers behind IP addresses and cookies. Lately, VPNs have been considered some of the master columns behind internet 32 Is Your VPN Trustworthy privacy, but sometimes they are not the key. Even the more so when people are concerned about their VPN providers, specially on free VPNs. Until now, users had to read the terms and conditions of their VPN providers offered them, read their privacy policy and trust that these providers would follow good practices and attach to their policies. However, with a tool like the one proposed, this should not be the only reason to trust them. On the other hand, this may have a huge impact on VPN providers and advertising companies, for one of their sources of income might disappear is the tool proposed is accomplished. As mentioned in the definition of the project, studies on VPN compromising the users privacy have been performed in different environments and using different strategies [18]. These type of studies are definitely useful to users who want to choose a VPN, however, they can not reach every solution and keep it up to date. A tool like the one proposed is not specific to a certain environment, for it works on an inferior level, the network layer. It can also be updated and maintained regularly, and therefore improves the other approaches. 33 Is your VPN trustworthy 6. Planning adjustments Regarding the initial tasks, there have been some changes during the project. The high risks associated to the tasks resulted in unexpected extensions in the time planning that required adjusting it. However, the most important parts of the project were successfully adapted to this changes. Due to time limitations, I considered TLS interception related tasks are now out of the scope of the project. The tasks related to identifying and isolating JavaScript Injection took way longer than expected. Because of their high complexity I had to remove TLS Interception tasks from the board, for they are not the main aim of the project. Therefore, I removed the task 9 TLS Interception. Due to the new necessities perceived, task 7 JavaScript Injection has a bigger scope now. The crawler not only has to analyze the contents of the web page, but also the resources it loads. This is done because I realized it could happen that VPN clients tracked clients not only by modifying the web page, but also by loading external resources. Therefore, the tool analyzes performance logs of the web page to check all the requests performed when the page is loaded. Then, if the resource is a JavaScript file, or any type of application related file, it downloads it and stores it as something to be analyzed. The analyzing part has also changed for now the JavaScript Injection crawler only crawls web pages, and the data is analyzed afterwards due to the high amount of it to analyze. The time planning has also changed. Task 7 JavaScript Injection took three more weeks than expected and 16 Test and results has been performed alongside the last. Therefore, since the delivery date has been postponed for three months, the rest of the dates have not changed, just been delayed. 34 Is your VPN trustworthy 7. State of the Art In this section further information regarding VPNs and add-ons will be provided regarding the current state of these. 7.1 VPNs A virtual private network (VPN) gives you online privacy and anonymity by creating a private network from a public internet connection.VPNs mask your IP address so your online actions are virtually untraceable. Most important, VPN services establish secure and encrypted connections to provide greater privacy than even a secured Wi-Fi hotspot [24]. Essentially, they create a protected data tunnel between your local data network and an exit node that can be in another location far from the original. This tunnel is protected with encryption. However, there are different levels of encryption as well. By default OpenVPN includes AES-128 [4], SHA-1 [34], and RSA-2048 [31], while maximum encryption includes AES-256 [34], SHA-256 [35], and RSA-4096 [31]. An encryption key tells your computer how to decrypt or encrypt data. Data authentication is part of the encryption process and refers to the message authentication algorithm with which user data is authenticated. This is used to protect users from active security attacks [3]. 7.1.1 Where can VPNs be installed VPNs are supported in many OS. Some of them are Windows, Mac OS X, iOS, Android, and Linux (Ubuntu) and Chrome book. They also work on mobile devices, like Android, IPhone and IPad. Some routers also support VPNs. Find some of the firmware that support VPNs below. 35 Is Your VPN Trustworthy Firmware package Cost Developer DD-WRT Free NewMedia-NET GmbH Gargoyle Free Eric Bishop OpenWrt Free Community driven development OPNsense Free Deciso BV Tomato Free Keith Moyer Table 7.1: Firmware that support VPNs 7.1.2 Are they anonymous? While most VPN providers claim they do not keep logs, it is true that most companies keep basic connection logs(User IP address and VPN timestamp). It is very important to check the companies privacy policy and the location of their headquarters (in terms of jurisdiction). It is also important to take into account the encryption standard used. Many VPN clients allow you to choose different standards. While the securer standards may slow down the internet connection, they will make sure your data is safer. Typically, your ISP would have to pay special attention to your activity in order to determine whether you are using a VPN or not. However, if well protected, they won’t be able to learn the nature of your activity. They are only able to see you are connected to a certain endpoint and the bandwidth you are using. If they want to learn more about you, they may request logs to your VPN provider (they probably need a court order to do that). See more information on this topics in the following subheadings. Personal information It is well known that companies keep personal information when we use their products. Now a days, it is very common (if not obligatory) that web pages ask you to accept their privacy policy and the use they give to your data (be by using cookies or any other means). When choosing a VPN service, it is very important to read carefully the privacy policy of that company in order to be aware of the data they store about us. It would make no sense that we used a VPN to hide our personal data ( IP, billing information, name, . .. ) but the VPN itself stores and uses 36 Is Your VPN Trustworthy that information! Different levels of logging Companies may have different logging levels. These are the three main categories: 1. Usage (browsing) logs – These logs basically include online activity: browsing history, connection times, IP addresses, metadata, etc. From a privacy standpoint, you should avoid any VPN that collects usage data. Most of the VPN services that are collecting usage logs are free VPN apps, which are basically spyware. The data they collect is then sold to third parties, thereby monitoring the “free VPN” service. 2. Connection logs – Connection logs typically include dates, times, connection data, and sometimes IP addresses. Typically this data is used for optimizing the VPN network and potentially dealing with user problems or terms of use issues (torrenting, illegal activities, ... ). 3. No logs – No logs simply means the VPN service is not keeping any logs whatsoever. Having a truly no logs policy can be difficult to implement while at the same time enforcing restrictions, such as device connections or bandwidth. This is especially the case when VPNs need to enforce restrictions such as bandwidth or the number of devices being used per subscription. While basic connection logs are not necessarily a problem, there is an increasing number of VPNs that keep connection logs, while falsely claiming to be a “no logs” service. Examples of this are Betternet, PureVPN, Windscribe, and TunnelBear. That is why it is very important to be aware of our VPN provider’s privacy policy and the jurisdiction of their headquarters [2]. Further considerations VPN servers [33] may use static or dynamic IP addresses. The later are the most common used. There are pros and cons for both approaches, and they can be important to the user depending on the use given to the VPN (and the budget available). Dynamic IP address •Pros - They provide greater anonymity for public WiFi hotspots, for they implement NAT and offer a wider range of IPs. 37 Is Your VPN Trustworthy •Cons - IPs can be abused by other users of the network [3], be it by spamming or hacking. This can lead to being banned from certain websites, or being suspicious of illegal activity. Static IP address •Pros - Unique IP for user. Harder to block by ISP or Network Administrators, since they use their own ports. •Cons - Expensive. Some VPN servers [33] offer built-in DNS protection. This happens because there is a wellknow flaw in some operative systems that, despite having routed the traffic through a VPN server [33], keep contacting websites using their original IP and DNS. This is a treat to your online security, anonymity and usefulness of your VPN. Al tough these DNS leaks can be prevented, it can be worth looking for a VPN with built-in protection. Notice that using a VPN does not protect you from malicious software. While some VPN providers offer additional protection, most do not. Viruses, spyware and malware can still harm you when you are using a VPN. Many VPN offer anonymous payment options, like Bitcoin, Altcoins, Alipay, CashU, PaySafe- Card, Gift Cards and others. These can be an extra anonymity layer to take into account. Deep packet inspection (DPI) [10] or packet sniffing is a type of data processing that inspects in detail the data being sent over a computer network [8], and usually takes action by blocking, re-routing, or logging it accordingly. It is used by ISPs, government agencies, and hackers to monitor and retain all of the data transmitted to and from your computer, including confidential and private information. To help customers bypass this, VPN providers are actively implementing modified OpenVPN protocols with added obfuscation layers, which masks VPN traffic away from view of DPI crawls. Check your VPN provider on this topic. 7.1.3 Free or Paid VPNs Free VPN services normally offer slower bandwidth and a smaller server [33] range. It is also important to consider that everyone wants to make a living, so while they claim to be free, they may make money using other means, which, in some cases, compromise the users confidentiality (see the case of Hola in the appendix). A legitimate and reliable paid VPN service offers several advantages, including a much more private environment, authentic guarantees, faster speeds, more servers [33], more extra features 38 Is Your VPN Trustworthy and add-on services, as well as being less likely to log traffic or connection logs. Normally, and given that you pay for them, they are more likely to be safe Name Connections Servers Speed Logs Type ProtonVPN 1 3 Medium None Full VPN Hotspot Shield 1 1 ? None Full VPN Windscribe 1 11 Low Connection Full VPN TunnelBear 1 20 Medium Browsing Full VPN Table 7.2: Free VPN examples. Name Connections Servers Speed Logs Type ProtonVPN 5 55 High None Full VPN Hotspot Shield 5 3200 High None Full VPN Windscribe 1 11 High Connection Full VPN TunnelBear 5 120 High Browsing Full VPN Table 7.3: Paid VPN examples. 7.1.4 What does a VPN hide? There is a lot of information that can be protected by means of using a VPN. Among it, we can find the following: •Your browsing history: Since they create an encrypted data tunnel, VPNs can hide your browsing history from your ISP and other unwated overseers by not showing them straight away the data running through your network. •Your IP address: IP addres, even though not the best, still is a common tracking technique. By hiding your personal IP address, VPNs can help mask your real identity. •Your Location: Your physical location is often discerned by external sources by means of the IP address. By masking your IP address, VPNs can also hide your location. 39 Is Your VPN Trustworthy •Your device: A VPN can help protect your devices, specially mobile ones by protecting your traffic wherever you go. Connecting to public Wi-Fi networks can put in danger your device’s data, but a VPN will help mitigating that. 7.2 Browser add-on Browser extensions main purpose is to extend your browser with additional features. To do this, they may modify webpages, use the browser storage or connect to external services, for example. However, they can be used to remove unwanted features or functionalities, like pop-up ads and other aspects of a websites core behavior that a user wishes to opt out of. Even though browser companies make some of these extensions, most of them are made by third-party developers. Finding out which ones to trust isnt always easy, although each browser will often offer you a selection depending on what you are trying to do with your machine. 7.2.1 What can they do? Depending on the browser, the permissions a extension can have differ. You may find quoted the permissions the extensions can use in Firefox browser [25] and in Chrome browser [9]. The truth is that extensions specify the permissions they require, and if users want to use them, they have to accept those permissions. However, to give some general ideas, browser extensions can normally access to the following data if they require to do so. •Clipboard. •Browser History. •Cookies. •Downloads. •Webpage document. •Browser local storage. •System data. 40 Is Your VPN Trustworthy 8.2.1 How does it work? Figure 8.3 show a diagram of its behaviour.The data processor can do two tasks: •Store resources in the DB: The data processor can store resources in the database to be later analyzed. It uses the folder structure created by the data crawler to deduce all the necessary data from the resource. Note that resources are categorized according, mainly to the following characteristics: when it was obtained, from which website it came, which extension was used and its contents. Therefore, I can organize Resources in specific Runs (when it was obtained), and Runs in RunCollections, according to their extension. However, to make resources themselves meaningful, they store the extension and webpage they belong to. Resources also store a Variety, that is, an example of that resource (content of the resource and MD5 hash). •Process data: The data processor can also use the resources stored in the database. The analyzing process is fairly simple: it consists on comparing all runs performed by a certain VPN extension to find common files in all of them. This sits on the hypothesis one. Then these common files are compared to the common files found in the list with no VPN extensions installed. The difference of the last two are the "suspicious" files, that are later analyzed manually. Resources are compared by similarity of their contents. When two resources reach a certain similarity threshold, I can say they are the same. This is because some scripts can be dynamically generated by the extensions and therefore contain small changes (like a URLs or a token). 8.2.2 Structure Figure 8.4 shows a UML diagram of the Processor. The main script chooses whether to store new resources in the DB or to start an analysis of what is present in it. 8.3 Technologies The original idea of the project was an extension-like software that was able to discern weather a specific web page had been injected JavaScript code by the extension. However, after analyzing 47 Is Your VPN Trustworthy Figure 8.3: Data Processor behaviour diagram. Source: Original. 48 Is Your VPN Trustworthy Figure 8.4: Data Processor Domain UML. Source: Original. more deeply the implications of this approach and the technologies available, I reached the conclusion that something like this would not work for two main reasons: 1. Our project compares resources found in a page with and without VPN extension. An extensions-like approach would make the user experience significantly slower, for each page would be visited a minimum of two times. 2. To be sure a resource does not belong to a site, I need to do as many visits to that site as possible. This would also make a live version of this product unfeasible, and therefore the extension approach does not fit our needs After discarding this approach, two more came to our minds. The first one was to create a service that would check for JavaScript injection in extensions indefinitely. The second, a scriptlike approach that would be executed when needed in a remote machine (like a computing server). For complexity reasons, the second approach was chosen. The other two issues that raised where how would I do the crawling of the web pages and compare the similarity of resources? After doing some research on these topics, I found the following options: 49 Is Your VPN Trustworthy 8.3.1 Crawling A Web crawler, sometimes called a spider or spiderbot and often shortened to crawler, is an Internet bot that systematically browses the World Wide Web, typically operated by search engines for the purpose of Web indexing (web spidering) [42]. •Octoparse: Desktop application made for automatic data extraction from web pages. No coding required. •Scrapy: Python library created to make the creation of web crawlers easy. •Selenium: Framework for automated software testing of web applications capable of interacting with browsers. In our case, Selenium [22] was the best choice, for it allows us to interact with a web browser, load self-made extensions and load dynamic JavaScript by interacting with the browser. Being Chrome one of the most used browsers, I used it in our tests. Note however, most of the extensions available in Chrome also exist for other browsers. 8.3.2 Data processing Given that Selenium was chosen for the data crawling, I needed a technology compatible with Selenium for the data processing. Python is a well-known programming language very popular because that lets you work quicker and integrate your systems more effectively, and of course can use the Selenium framework along with many other libraries. Therefore, at this point of the project I focused in finding answers in Python regarding how to compare two files to tell how similar they are. There are a lot of studies regarding NLP [23] and similarity of sets [12]. In this project, the datasketch 1.5.3 module from Python was used, more specifically their MinHash implementation. it lets you estimate the Jaccard similarity (resemblance) between sets of arbitrary sizes in linear time using a small and fixed memory space [21]. MinHash and Jaccard similarity is useful to detect document resemblance and repeated documents in a large dataset, as proved my Andrei Z. Broder in his paper [6]. 50 Is your VPN trustworthy 9. Final results In this section you will find an analysis of the results obtained by the project described in the previous sections. That is, the result of analyzing the data obtained with the Crawler module using the Data Processor module. To sum up the behaviour of the Crawler module, it launched automated crawlers that navigated through a certain list of web pages several times. Each of those visits to each of those web pages started with a clean storage, so that previous web pages visited or previous visits to that page do not alter the contents of that page in that visit. When a page was visited by the crawler, it downloaded every script and iframe that page had, along with every external resource loaded that belongs to the types "text/*", "application/*" according to the request used to load it. Regarding the Data Processor module, it stored the files of the crawler in the database if they were new and then analysed them by two means. Firstly, it searched for files common in all usages of a certain VPN extension (to discard web page-specific resources) and also compared those common files to the common files of that list of web pages visited by a browser with no VPN extension at all (to discard common resources loaded by all those web pages). In the following sections I will discuss the results found for all extensions tested. Furthermore, the results of the project will be compared with what the Privacy Policy of each of these products says regarding user data collection and usage. 9.1 Metadata Analysis Before proceeding to look for files injected by the VPN extensions, a general data analysis was performed. In this section you will find the results obtained from said analysis. The figures mentioned in this section are bar charts. These show the number of resources loaded in a specific web page of the list on average by all extensions. Note that the normal bar charts contain a 51 Is Your VPN Trustworthy dotted line. It is there only to help visualize the number of resources the page has without a VPN active compared to the others. In all charts, NO_VPN refers to the results obtained without any VPN extension loaded. Note that buydomains.com has no data for Hola and PP. This is because attempts to visit this page were producing timeouts, in some extensions more than in others. Hola and PP always produced timeout error. This probably means this web page is blocking connections from known VPN servers. The data shown in figures 9.1 and 9.2 indicates that, in general, when a web page is visited with a VPN extension of the ones mentioned on table1.1 it loads more resources of types text/* and application/*javascript than usual. And this same thing may indicate that the extensions is injecting code onto the page. It could also be that the extension is using external resources during its normal behaviour. This rises the need of finding what this additional loaded resources are. This is specially noticeable in the charts of abc, elmundo, elpais and lefigaro. These sites normally contain ads of their own. That is why I think they are more likely to be injected ads by the VPNs, for they will most likely remain unnoticed. After executing the data processor, three examples of this additional resources have been found. The following sections analyze these resources found and give a bit of context on the VPN extension that loaded them and its privacy policy. 9.2 Hola VPN Hola, based out of Israel, is mainly a free VPN service. It also offers paid subscriptions. Hola was the first P2P based VPN service created. But this VPN services did not become famous for its improvements, but for its bad practices. Their privacy policy [15] states that: •Location of their headquarters - They are located in Israel, outside the 14-Eyes Countries and Jurisdiction [13]. However, Israel is cooperative with this alliance, where they share all their espionage information. •Logging level - They log the following data: browser type, web pages visited, time spent on this pages, access times and dates. We could say they know nearly everything about your internet activity. They store usage logs. 52 Is Your VPN Trustworthy Figure 9.1: Common resources found in all runs of pages (One). Source: Original. 53 Is Your VPN Trustworthy Figure 9.2: Common resources found in all runs of pages (Two). Source: Original. •Personal data - They store your IP address, name, email and they may share it to "subsidiaries and affiliated companies". •Encryption level - Non-existent. Hola VPN uses a HTTP proxy tunnel, transmitting information in plain text. Hola is a special type of VPN that uses a P2P network to provide its services, as mentioned above. This means that users themselves are used as proxy servers, with all the security risks this implies. Take into consideration that, when using this VPN, other users can use your computer bandwidth for illegal purposes. Furthermore, they are aware that malicious users may bypass their security checkups and gain access to your computer and they are warning you about that in their security policies, saying they will try their best to fix this issues. Furthermore, the results obtained by the Data Processor reveal that Hola VPN is injecting file 11.1.1 in every web page visited. This script is most likely related with tracking, as the element "pageAnalytics" indicates in line 5. It also interacts with an object called ga_data in lines 7-8, which is most likely referring to Google Analytics data. Considering their privacy policy mentions they log pages visited and time spent in them (browsing data), it makes sense to think they use the previous script, maybe among other methods, to track this parameters. 54 Is Your VPN Trustworthy I have also compared the pages visited with no VPN and with Hola VPN active. Figures 9.3 and 9.4 show clear examples of injected ads in websites. In fact, Example 2 does not have an ad injected, but thew page was modified to insert the add adding a blank space and the ad failed loading. 9.3 Hotspot Shield Hotspot Shield, based in the United States is mainly a paid VPN service. However, it also offers a free subscription that implies receiving personalized advertisements. The following analysis will be centered on the free version of the VPN, for it is the one I have analyzed. •Location of their headquarters - Hotspot Shield is headquartered in the US, one of the founding members of the 5/9/14-Eyes Alliance [13]. •Logging level - They say they only store connection logs, but the information in their logs is abundant. They log the following data: Email, Username, Unique mobile ID, Hardware model, OS version, language, "Network information" (Not specified), Location, Advertising ID, MAC Address. •Personal data - Free users personal information is shared with third-party companies. That is: location, Advertising ID, Mobile ID, MAC Address and Wireless carrier. •Encryption level - It uses 256-bit AES. Their privacy policy states that they may place specific advertisements and share personal information with third parties. The data processor has found the two files 11.1.2 and 11.1.2 repeated throughout the web page list. Due to the length of the isolated file found for this VPN, the appendix only contains the relevant parts of it for this project. The file 11.1.2 uses a scraper in line 6 to obtain the data specified in the string contained in the variable "userKeys". Among other parameters, it tries to obtain the user gender and age, which are not specified in the Privacy Policy of said VPN. File 11.1.2 has to do with Amazon Advertisement service. Even though the script is too big to fully comprehend all the actions behind it, references to the AdServer, iframes and ads in general are found in multiple places in the script. The amazon ad server is referenced in multiple lines, along with some of its domains. Therefore, and in conjunction with what is found in the 55 Is Your VPN Trustworthy Figure 9.3: Example 1. On top, page visited with no VPN extension. At the bottom, page visited with Hola VPN. Source: Original. 56 Is your VPN trustworthy 11. Appendix 11.1 Source code 11.1.1 hola files hola_file01 •MD5 hash: 00308765366b9ea57d09ef5c8a6b0074 •Beautified Content: 1< 2script > 3function firePromoAnalytics(e) { 4try { 5var analytics =document.getElementById("pageAnalytics"); 6if (analytics) { 7var bpt =window.ga_data.route.basePageType, 8ssts =window.ga_data.route.ssts.replace('/', 9':'), 10 parent =getParentByTagName(e.target, 'A'), 11 index =e.target.dataset.index || parent.dataset 12 .index || 0, 13 localName =e.target.dataset.moduleName || parent 14 .dataset.moduleName || ''; 15 16 if (bpt === 'homefront') { 17 ssts ='home' 18 } 19 20 if (index && parseInt(index)) { 21 index =parseInt(index); 22 } 23 24 var eventString =bpt +':'+ssts +':'+localName + 25 ':'+index; 26 analytics.fireEvent(eventString, {}, true); 63 Is Your VPN Trustworthy 27 }else { 28 if (window.newrelic) window.newrelic.noticeError( 29 'page analytics tag not found'); 30 } 31 }catch (ex) { 32 if (window.newrelic) window.newrelic.noticeError(ex); 33 } 34 } 35 36 function getParentByTagName(el, tag) { 37 while ((el =el.parentElement) && el.tagName !== tag); 38 return el; 39 }< 40 /script> 11.1.2 hotspot files hotspot_file01 •MD5 hash: 00308765366b9ea57d09ef5c8a6b0074 •Beautified Content: 1<script > 2(function() { 3var attr, config, custDelimit, dataObj, libUtil, omitKeys, 4prefix, userKeys; 5libUtil =Krux('require:util.library-tag'); 6dataObj =Krux('scrape.javascript','gciKruxData'); 7userKeys = 8'userGender,userMeterState,userPersonalizedLinkId,userPersonalizedLinkSessionId,userStatus,userYearOfBirth,userZipCode,user-anonymous-id,user_guid,user_meter_state,user_status,user_anonymous_id,userInsightsBenefitsSegment,userInsightsDoLookAlike,userInsightsUsageCohort,userGooglePropensityToSubscribe'; 9omitKeys ='none'; 10 custDelimit ='none'; 11 prefix =libUtil.resolvePrefix('text','web', 12 'undefined'); 13 config ={ 14 'userKeys':userKeys ?userKeys.split(','): 15 void 0, 16 'omitKeys':(omitKeys ?omitKeys.split(','):[]) 17 .concat([/gtm\./, 18 /sessionid/i,/\.phpsessid$/i, 19 /\.sid$/i,/\.zenid$/i, 20 /\.requestid$/i 21 ]), 22 'omitValues':[/.*@.*(?:\..*)+/,/gtm\./, 23 /^(https?:)?\/\/[^\/]+/, 24 /^\/[^\/]+/,/.{255}/ 25 ], 64 Is Your VPN Trustworthy 26 'customDelimited':custDelimit ?custDelimit 27 .split(','):void 0, 28 'caseSensitive':'web'=== 'true', 29 'useFullPath':'false'=== 'true', 30 'useLastValue':'false'=== 'true', 31 'optimizeNames':'false'=== 'true', 32 'convertAttrNames':[] 33 }; 34 if (prefix) { 35 config.convertAttrNames.push({ 36 pattern:/((?:page|user)_attr_)/, 37 replacement:'$1'+prefix 38 }); 39 } 40 attr =Krux('ingestDataLayer', dataObj, config); 41 }).call(); < 42 /script> hotspot_file02 This file is not full in thsi document for length reasons. However, you may find the relevant parts of the file below. When code is removed from the file, the following string is used to indicate it: /* [...] */. •MD5 hash: bd8f224a043d5da15665d4e3a88b97e2 •Beautified Content: 1/*! amazon-dtb-javascript-api - apstag - v7.59.00 - 2021-01-25 10:26:47 */ ! 2/* [...] */ 3function f() { 4var t="amzn_lsTest"; 5try { 6return window.localStorage.setItem(t, t), window.localStorage 7.removeItem(t), !0 8}catch (t) { 9return !1 10 } 11 } 12 13 function b() { 14 return document.cookie.split("; ").map((function(t) { 15 return t.split("=") 16 })) 17 } 18 19 /* [...] */ 20 21 function m(t) { 22 try { 23 var e=t.innerWidth || t.document.documentElement.clientWidth || t 24 .document.body.clientWidth, 25 n=t.innerHeight || t.document.documentElement.clientHeight || t 26 .document.body.clientHeight; 27 return "".concat(e, "x").concat(n) 28 }catch (t) {} 29 return "x" 30 } 31 65 Is Your VPN Trustworthy 32 /* [...] */ 33 34 displayAdServer:function(t, e) { 35 switch (e.type) { 36 case "SLOT_RENDER_ENDED_SET": 37 return s(s({}, t), {}, { 38 slotRenderEndedSet: !0 39 }); 40 case "NO_BID_ON_ADSERVER_SLOTS": 41 return s(s({}, t), {}, { 42 noBidSlotIDs:t.noBidSlotIDs.concat(e.slotIDs) 43 }); 44 case "REQUESTED_BID_FOR_ADSERVER_SLOTS": 45 return s(s({}, t), {}, { 46 noBidSlotIDs:t.noBidSlotIDs.filter((function(t) { 47 return !Object(o.j)(e.slotIDs, t) 48 })) 49 }); 50 case "SHOULD_SAMPLE_SLOT_RENDER": 51 return s(s({}, t), {}, { 52 shouldSampleRender:e.value 53 }); 54 default: 55 return s(s({}, t), {}, { 56 noBidSlotIDs:d(t.noBidSlotIDs) 57 }) 58 } 59 60 /* [...] */ 61 62 var r, i, o =["amznbid","amzniid","amznsz","amznp"], 63 c=["amznbid","amzniid","amznp","r_amznbid","r_amzniid", 64 "r_amznp"]; 65 (i =r=r|| {}).new ="NEW", i.exposed ="EXPOSED", i.set ="SET", i 66 .rendered ="RENDERED"; 67 var a, s, u, d ="apstagDebug", 68 f=["redux","fake_bids","verbose","console","console_v2", 69 "errors"], 70 l="apstagDebugHeight", 71 b="apstagDEBUG", 72 p="apstagCfg", 73 m= 0, 74 g= 0; 75 (s =a=a|| {}).amznbid ="testBid", s.amzniid ="testImpression", s 76 .amznp ="testP", s.crid = 77 "testCrid", (u || (u ={})).video ="v"; 78 var y, h, O, j, v =["amznbid","amznp"]; 79 (h =y=y|| {}).__apsid ="ck", h.__aps_id_p ="ckp", h.aps_ext_917 = 80 "st", (j =O=O|| {}) 81 .noRequest ="0", j.bidInFlight ="1", j.noBid ="2"; 82 var S="600", 83 _="7.59.00", 84 w="https://", 85 D="function" == typeof XMLHttpRequest && void 0 !== ( 86 new XMLHttpRequest).withCredentials, 87 E="apstagLOADED", 88 T= 13, 89 I= 1e4 90 }, 91 92 /* [...] */ 93 94 function l(t) { 95 var e=new Image; 96 return e.src =t, f.push(e), e 97 }!0 === Object(o.c)("exposePixels")&& (window.apstagPixelQueue =u, 98 window.apstagPixelsSent =f); 99 var b, p ={ 100 adServer:[], 101 ampAdContext:[], 102 appended:[], 103 AaxSlotSizes:[], 104 bidRender:[], 105 bidRenderState:[], 106 bidType:[], 107 "blockedBidders-fetchBids":[], 108 "blockedBidders-init":[], 109 ccpa:[], 110 cmpVar:[], 111 creativeSize:[], 112 deals:[], 66 Is Your VPN Trustworthy 113 fetchBids:[], 114 fifFlow:[], 115 gdpr:[], 116 idRemap:[], 117 iframe:[], 118 renderFootprint:[], 119 resizeIframe:[], 120 schain:[], 121 simplerGpt:[], 122 slots:[], 123 slotType:[], 124 targeting:[], 125 tcfVar:[], 126 unusedDeal:[], 127 useSafeFrames:[] 128 }, 129 m=[], 130 g= !1; 131 132 /* [...] */ 133 134 function f(t) { 135 var e=function() { 136 if ("undefined" == typeof Reflect || !Reflect.construct) return !1; 137 if (Reflect.construct.sham) return !1; 138 if ("function" == typeof Proxy)return !0; 139 try { 140 return Date.prototype.toString.call(Reflect.construct(Date, [], ( 141 function() {}))), !0 142 }catch (t) { 143 return !1 144 } 145 }(); 146 return function() { 147 var n, r, i, o =b(t); 148 if (e) { 149 var a=b(this).constructor; 150 n=Reflect.construct(o, arguments, a) 151 }else n=o.apply(this, arguments); 152 return r=this,!(i =n) || "object" !== c(i) && "function" != 153 typeof i?l(r) :i 154 } 155 } 156 157 158 var m=function() { 159 d(e, i.c); 160 var t=f(e); 161 162 function e(n) { 163 var i; 164 return a(this, e), p(l(i =t.call(this, n.targetId, Object(r.m)(n, 165 "invCode")?n.invCode : 166 Object(r.m)(n, "tagId")?n.tagId :n.targetId)), "rawSlot", 167 void 0), p(l(i), "mediaType", 168 "display"), i.rawSlot =n, i 169 } 170 171 /* [...] */ 172 173 return u(e, [{ 174 key:"reportError", 175 value:function(t, e) { 176 Object(o.b)(t, "AppNexusAdServer-".concat(e)) 177 } 178 }, 179 180 /* [...] */ 181 182 }, { 183 key:"setTargeting", 184 value:function(t, e) { 185 try { 186 if (!Object(r.m)(window,"apntag")|| !Object(r.m)( 187 window.apntag, "requests")) return; 188 Object(r.m)(window.apntag.requests, "keywords")|| ( 189 window.apntag.requests 190 .keywords ={}), window.apntag.requests.keywords[ 191 t] =e 192 }catch (t) { 67 Is Your VPN Trustworthy 193 this.reportError(t, "setTargeting") 194 } 195 } 196 }, { 197 key:"getTargeting", 198 value:function(t) { 199 try { 200 if (!Object(r.m)(window,"apntag")|| !Object(r.m)( 201 window.apntag, "requests")) 202 return []; 203 Object(r.m)(window.apntag.requests, "keywords")|| ( 204 window.apntag.requests 205 .keywords ={}); 206 var e=window.apntag.requests.keywords[t]; 207 return void 0 === e?[] :[e] 208 }catch (t) { 209 return this.reportError(t, "getTargeting"), [] 210 } 211 } 212 }, 213 214 /* [...] */ 215 216 { 217 key:"hasAdServerObjectLoaded", 218 value:function() { 219 try { 220 return Object(r.m)(window,"apntag")&& Object(r.m)( 221 window.apntag, "loaded")&& !0 === 222 window.apntag.loaded 223 }catch (t) { 224 return this.reportError(t, "hasAdServerObjectLoaded"), ! 225 1 226 } 227 } 228 }, 229 230 /* [...] */ 231 232 233 return t=c, (e =[{ 234 key:"reportError", 235 value:function(t, e) { 236 Object(o.b)(t, "SmartAdServer-".concat(e)) 237 } 238 }, { 239 key:"cmdQueuePush", 240 value:function(t) { 241 try { 242 window.sas.cmd.push(t) 243 }catch (t) { 244 this.reportError(t, "cmdQueuePush") 245 } 246 } 247 }, { 248 key:"hasAdServerObjectLoaded", 249 value:function() { 250 try { 251 return Object(r.m)(window,"sas")&& Object(r.m)(window 252 .sas, "__smartLoaded")&& ! 253 0 === window.sas.__smartLoaded 254 }catch (t) { 255 return this.reportError(t, "hasAdServerObjectLoaded"), ! 256 1 257 } 258 } 259 }, 260 261 /* [...] */ 262 263 function o(t) { 264 var e=[]; 265 try { 266 t.hasAdServerObjectLoaded() && (e =t.getSlots()) 267 }catch (t) { 268 Object(r.b)(t, "getDisplayAdServerSlots") 269 } 270 return e 271 } 272 273 /* [...] */ 68 Is Your VPN Trustworthy 274 275 if (Object(y.m)(e.data, "renderData")) { 276 var d=e.data.renderData, 277 f=d.id; 278 if (Object(y.m)(d, "renderStart")|| Object(y.m)(d, 279 "renderEnd")) { 280 var l=d.renderStart, 281 b=d.renderEnd; 282 if (l) t.renderTimes[f] =l; 283 else if (b && 0 !== t.renderTimes[f]) { 284 var p=b-t.renderTimes[f], 285 m={ 286 _type:"iframeRender", 287 c:"dtb", 288 pid:O.b, 289 crt:p 290 }; 291 Object(j.b)(m) 292 } 293 } 294 } 295 if (Object(y.m)(e.data, "blockData")) { 296 var g=e.data.blockData.blockInfo, 297 h={ 298 _type:"malwareBlock", 299 c:"dtb", 300 tpbr: 1, 301 pid:O.b, 302 info:g 303 }; 304 Object(j.b)(h) 305 } 306 } 307 }), !0) 308 } 309 }, 310 311 /* [...] */ 312 313 function D(t, e) { 314 try { 315 return Object(qt.k)(Lt.a.getState().targetingKeys[t]) ?e?[ 316 "amzniid_sp" 317 ]:Lt.a.getState() 318 .targetingKeys[t].filter((function(t) { 319 return -1 < t.indexOf("amzniid")&& t.indexOf( 320 "amzniid_sp")< 0 321 })) :["amzniid"] 322 }catch (t) { 323 return Object(Xt.b)(t, "_getAllBidIdKeys"), [] 324 } 325 } 326 327 try { 328 if (Object(Gt.c)("iframe","friendly"), void 0 === t.html) 329 throw new Error( 330 "No HTML available for ad, most likely the creative has expired" 331 ); 332 t=ne({ 333 hasRendered: !1, 334 hasTimedOut: !1 335 }, t), (e =N(t)).id ="apstag-f-iframe-".concat(Object(qt 336 .e)()), B(t.doc, e, ( 337 function() { 338 var t=r.bind(null,!1); 339 try { 340 n=null !== e.contentDocument && Object(qt.j)([ 341 "complete","interactive" 342 ], e 343 .contentDocument.readyState) ?(t(), 344 "doc-ready"):null !== e 345 .contentDocument && "uninitialized" !== e 346 .contentDocument.readyState ?(e 347 .contentDocument.addEventListener( 348 "DOMContentLoaded", t), "dom-listener"):(e 349 .addEventListener("load", t), "iframe-listener" 350 ), Object(Gt.c)("fifFlow", n), 351 setTimeout(r, 1e3, !0) 352 }catch (t) { 353 Object(Xt.b)(t, 354 "_loadAdIntoFriendlyIframe-setAttributes") 69 Is Your VPN Trustworthy 355 } 356 })) 357 }catch (t) { 358 Object(Xt.b)(t, "_loadAdIntoFriendlyIframe",!0) 359 } 360 } 361 362 /* [...] */ 11.2 Tracking Techniques In this section you may find some information regarding non-VPN related tracking techniques. 11.2.1 Tracking cookies While using a VPN can hide yourIP address from the internet, cookies can still track your activity. Tracking cookies are not blocked by your VPN when browsing the internet, and they are not removed from your system afterwards either. However, your web browser can do that for you. Every web browser can block third-party cookies and remove all of them after the browsing session has finished (when you exit the browser ), and if yours does not, you should think about changing your web browser. Sometimes this is as simple as browsing in incognito mode. A VPN, however, can help in the sense that it will hide from cookies your real IP address, since the VPN server is the one connecting to the internet. Therefore, IP based identification will not work on you. But all the other information will be there: browsing history, queries performed, preferences... 11.2.2 Referrer URLs A referrer URL is the web address of the previous website where you clicked a link to get to the current website. These can be used for several reasons, and recording your browser history is one of them. They are often used alongside with cookies, but these are not required in order to use referrer URLs. If someone clicks on a link to example.org at example.com/links.htm, then example.org'svisitor log will show example.com/links.htm as his referral URL [16]. Some web browsers have an option not to send referral URL information to websites. Generally speaking, VPNs do not do that. Users may also do this manually by copying the link address and pasting it into the browser’s address bar. 70 Is Your VPN Trustworthy 11.2.3 Web beacons A web beacon is a technique used on web pages and email to unobtrusively (usually invisibly) allow checking that a user has accessed some content . The first web beacons were small digital image files that were embedded in a web page or email. The image could be as small as a single pixel, and could be of the same color as the background, or completely transparent (thus the name “tracking pixel”). When a user opens the page or email where such an image was embedded, they might not see the image, but their web browser or email reader would automatically download the image, requiring the user’s computer to send a request to the host company’s server, where the source image was stored. This request would provide identifying information about the computer, allowing the host to keep track of the user. The identifying information provided by the user’s computer typically includes its IP address, the time the request was made, the type of web browser or email reader that made the request, and the existence of cookies previously sent by the host server. The host server can store all of this information, and associate it with a session identifier or tracking token that uniquely marks the interaction. 11.2.4 Browser fingerprinting A device fingerprint, machine fingerprint or browser fingerprint is information collected about a remote computing device for the purpose of identification. Fingerprints can be used to fully or partially identify individual users or devices even when cookies are turned off. The attributes of the fingerprint depend on the web application, for each of them may use a different set of attributes. For reference, amiunique.org uses the following data to create their fingerprint: •the User agent header •the Accept header •the Connection header •the Encoding header •the Language header •the Upgrade Insecure Requests header 71 Is Your VPN Trustworthy •the Referer header •the Cache-Control header •the BuildId of the browser •the list of plugins •the platform •the cookies preferences (allowed or not) •the Do Not Track preferences (yes, no or not communicated) •the timezone •the screen resolution and its color depth •the use of local storage •the use of session storage •a picture rendered with the HTML Canvas element •a picture rendered with WebGL •Supported Audio formats •Supported Video formats •the presence of AdBlock •the list of fonts Nor VPNs, nor most ad-blockers can protect users from this type of tracking. Some adblockers are working on blocking this type tracking by removing the HTML canvas element from a web page when certain conditions are met, for this is usually used for tracking purposes. 11.2.5 Cookie syncing The biggest problem cookies face is that they can only be read on the domain that created them. This means that AdTech companies can’t read cookies created by other AdTech platforms or by the website itself, essentially limiting their effectiveness for advertising purposes on other 72