Like all software, VPNs (Virtual Private Networks) are frequently targeted by hackers. And while industry leaders have made their protection nearly impossible to crack, some smaller VPN providers have vulnerabilities that lead to millions of user records being exposed every year.
If you don’t want to be on the list of people who got their data breached, follow along and learn all about VPN vulnerabilities and how to choose a secure VPN provider.
Table of contents
How can a VPN be hacked?
Hackers look for weaknesses anywhere within a VPN provider’s infrastructure. If they manage to find a crack, they’ll surely find a way to squeeze through, which usually results in data theft, fraud, identity theft, and a whole heap of other things you don’t want to be a part of. Here are a few things that hackers commonly look for when targeting VPNs:
Outdated VPN protocols
VPN protocols are sets of rules that define how data and traffic are routed between your device and the VPN server. Protocols such as OpenVPN, WireGuard, or IKEv2 have no known vulnerabilities and are considered secure. But there are others, such as PPTP, SSTP, or L2TP, that have security issues yet are still used by some VPN providers.
If you use a VPN with one of the outdated protocols, you’re putting your sensitive information at risk. Thankfully, they’re not used by any premium VPN providers, but some free VPNs still utilize the likes of PPTP or L2TP, which partly contributes to the large number of data leaks from free VPNs.
Weak encryption
VPNs use encryption to turn your data into ciphertext before it leaves your device. Your traffic looks like gibberish code while it travels to the VPN server. So, even if someone were to intercept your connection, they would not be able to read the information that’s being transmitted.
The security of the encryption depends on the cipher used and the length of the encryption key. AES-256 is the industry standard encryption for protocols such as OpenVPN and IKEv2, while ChaCha20 is used for secure encryption with WireGuard. Make sure to choose a provider that uses these encryption algorithms, as most others can be cracked with modern technology.
Encryption keys
Encryption keys are used to encrypt and decrypt the data that travels from your device to the VPN server. If a hacker gets a hold of them, it becomes possible to break even a secure encryption cipher. The hard part is actually stealing the keys since it requires immense resources and knowledge.
Some good VPN providers, including Surfshark, have implemented Perfect Forward Secrecy (PFS) to protect users from this threat. It changes the keys used in encryption faster than bad actors can use them to break the cipher, making the encryption nearly impossible to break, even with encryption keys.
Vulnerable servers
Sometimes, hackers target VPN providers directly instead of targeting their users. And VPN servers are one of the most common targets. Premium VPN providers have largely moved to RAM-only servers and undergo regular server infrastructure audits. But some smaller providers still store user data on hard drives and use questionable security practices.
Hackers target servers with lousy login credentials or weak configuration to gain access to user data. However, physical seizing of servers isn’t unheard of as well, with oppressive governments sometimes trying to take over VPN servers in an attempt to access user activity data. In order to keep yours safe, make sure to use a VPN with a secure server infrastructure.
What happens if your VPN is hacked?
When a VPN is hacked, bad actors can gain access to your sensitive information and internet traffic or even make you vulnerable to Man-in-the-Middle (MITM) attacks. This can result in identity theft, fraud, stolen accounts, being infected with malware, and more.
Here are some of the most common things hackers do if they manage to compromise your VPN:
- Data theft — hackers often try to steal your activity data, which can be used for elaborate phishing attacks or sold to advertisers, who use this data to run targeted ads;
- Fraud — when your VPN is hacked, bad actors can access your personal information, including your banking details. It can then be used for identity theft, taking out loans in your name, or draining your bank account;
- Malware — a hacked VPN won’t directly allow hackers to install malware on your devices, but it will definitely make them more vulnerable to MITM and other attacks that can result in hackers taking over your device.
What should you do if your VPN has been hacked?
Finding out that your VPN got hacked is never a pleasant experience. But it’s important to keep a cool head and take the necessary steps to minimize the damage. Here’s what you should do as soon as you learn about your VPN provider being hacked:
- Uninstall your VPN on all devices and restart them;
- Change the passwords on all your accounts;
- Use an antivirus to run a malware scan;
- Check for fraudulent activity on your bank account;
- Look for any apps or extensions that you didn’t install. If you find any, uninstall them;
- Choose a reputable VPN such as Surfshark and stay safe online.
How to choose a VPN to stay safe from hackers
There is no way to tell for sure that a VPN service will never get hacked in the future. But you can look at certain VPN features and see if it’s taking the required measures to ensure the best security possible for its users.
Secure VPN protocols and encryption
OpenVPN, IKEv2, and WireGuard are some of the safest VPN protocols available today. They’re usually accompanied by AES-256 and ChaCha20 encryption algorithms. They are the ones you can trust for a secure connection.
Some premium VPN providers also have proprietary protocols that are considered to be safe, such as NordVPN’s NordLynx or ExpressVPN’s Lightway. Whatever you choose, make sure your VPN provider isn’t using outdated protocols like PPTP or SSTP.
No activity logs
Look for a VPN that doesn’t keep logs of your activity, ideally one that has its no-logs claim approved by an independent auditor. Since no data about your activity is kept, there’s not much for bad actors to steal, even if they do manage to penetrate the VPN provider’s defenses.
RAM-only servers
We’ve already established that hackers can target VPN servers directly, which is why it’s essential to ensure their security. RAM-only servers don’t have hard drives, which means they don’t have the capacity to hold any data. Whenever the server shuts down or restarts, all data is wiped clean, essentially nulling the consequences of a hacker attack.
Kill Switch
Kill Switch is a feature that shuts down your internet if your VPN connection drops. While it doesn’t directly protect your VPN from being hacked, it prevents data leaks if there’s an issue with the VPN itself. Make sure to choose a VPN that offers this feature for that extra bit of security just in case things go wrong.
Audits
If a VPN takes its security seriously, it will undergo independent audits by reputable auditing firms. It allows providers to filter out and get rid of any possible threats before anyone else takes advantage of them. Audit reports are usually publicly available, so users can see that they’re choosing a truly secure VPN service.
Stay safe by choosing a reliable VPN service
In theory, all VPN providers can get hacked. But practice shows that it rarely happens to premium VPN providers, with most security issues being caused by free VPNs that simply don’t have the budget to maintain a secure infrastructure.
If you choose to go with a long-term subscription, a premium VPN like Surfshark can cost as little as $2.49/month, which is a small price to pay for privacy and security online.
FAQ
Is using a VPN really safe?
Using a VPN is safe as long as you choose a reliable VPN service provider. Any good VPN should use secure protocols and encryption algorithms, keep no logs of user activity, have RAM-only servers, and be regularly audited. You can only find this with a premium VPN service, while free VPNs tend to be much less safe to use.
Can hackers see you when you’re using a VPN?
No, hackers can’t see your activity when you’re using a VPN. Even if they managed to break into your network, they would only see gibberish code because a VPN encrypts your traffic before it leaves your device, keeping it safe at all times.
What will a VPN not protect you from?
A VPN won’t be able to protect you if you click on malicious links or download infected files. It also won’t protect your device if it already has a virus or from any other offline threats. That’s why it’s best to use a VPN together with a reliable antivirus for optimal security.
