Thursday, 9 August 2018

A bug that affects million users - Kaspersky VPN

Hi Internet,

Summary:
The issue exists in Kaspersky VPN <=v1.4.0.216  which leaks your DNS Address even after you're connected to any virtual server. (Tested on Android 8.1.0)

What is a DNS leaks ?
In this context, with "DNS leak" it means an unencrypted DNS query sent by your system OUTSIDE the established VPN tunnel.

Kaspersky VPN is one of the most trusted VPN which comes with 1,000,000+ tier downloads in android market, however it was observed that when it connects to any random virtual server still leaks your actual DNS address, this issue was reported too Kaspersky via Hackerone.

Steps to reproduce:
1. Visit IPleak (Note your actual DNS address).
2. Now, connect to any random virtual server using Kaspersky VPN.
3. Once you are successfully connected, navigate to IPleak you will observe that the DNS address still remains the same.

I believe this leaks the trace's of an end user, who wants to remain anonymous on the internet. I reported this vulnerability on Apr 21st (4 months ago) via H1, and a fix was pushed for same but no bounty was awarded.

“Kaspersky Lab would like to thank Dhiraj Mishra for discovering a vulnerability in the Android-based Kaspersky Secure Connection app, which allowed a DNS service to log the domain names of the sites visited by users. This vulnerability was responsibly reported by the researcher, and was fixed in June.

The Kaspersky Secure Connection app is currently out of the scope of the company’s Bug Bounty Program, so we could not reward Dhiraj under the current rules. We highly appreciate his work, and in the future the program may include new products. As stated in Kaspersky Lab’s Bug Bounty Program rules, bounties are currently paid for two major products: Kaspersky Internet Security and Kaspersky Endpoint Security. The company is ready to pay up to $20,000 for the discovery of some bugs in these products, and up to $100,000 for the most severe."

However, this was featured on TheRegister and BleepingComputer.



Regards
Dhiraj 
Share:

25 comments:

  1. A few good free vpn alternative to chose from: https://www.vpnmentor.com/blog/top-really-free-vpn-services/

    ReplyDelete
  2. I love significantly your own post! I look at all post is great. I discovered your personal content using bing search. Discover my webpage is a great one as you.I work to create several content this post. Once more you can thank you and keep it create! Enjoy! visit website

    ReplyDelete
  3. Just pure brilliance from you here. I have never expected something less than this from you and you have not disappointed me at all. I suppose you will keep the quality work going on. prywatnoscwsieci

    ReplyDelete
  4. I have looked couple of days and discovered some spellbinding formed work on it. In any case, it is the best of all. privatnostonline.com

    ReplyDelete
  5. Much obliged to you for peopling get the data they require. Extraordinary stuff of course. Keep up the colossal work!!!  www.lemigliorivpn.com

    ReplyDelete
  6. This comment has been removed by the author.

    ReplyDelete
  7. I'm unquestionably going to investigate it. Truly exceptionally valuable tips are given here. Much obliged to you to such an extent. Keep up the benevolent acts.
    http://eniyivpn.net/ 

    ReplyDelete
  8. I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post. vpnveteran

    ReplyDelete
  9. Get ivacy vpn. it is the best vpn in streaming content securely. https://www.ivacy.com/netflix-vpn

    ReplyDelete
  10. Have you heard Ivacy VPN is offering 90% off on their lifetime Subscription for this Christmas and New Year Season only. This is the biggest discount you can get from Ivacy. So What is the wait? Go Buy VPN now from Ivacy.

    ReplyDelete
  11. Get the Fastest VPN for 2019 that allows you to access blocked and restricted content from anywhere in the world. Stream and Download with complete anonymity and security. FastestVPN service provider offers secure access and high speed.
    Highlighted Categories Are:
    XBOX
    Linux
    Router
    Torrenting
    Kodi Addons

    ReplyDelete
  12. This comment has been removed by the author.

    ReplyDelete
  13. Really your blog is very interesting.... it contains great and unique information. I enjoyed to visiting your blog. Its just amazing.... Thanks very much. Klik hier

    ReplyDelete
  14. You are writing some interesting and best content I also bookmark this URL .You guys are writing some Amazing tips. Thanks for sharing this. Totally Awesome Post Please Keep Posting Regularly.
    echobeat earbuds review
    chargeboost reviews
    liporing review
    doc socks
    livewave antenna review
    livewave antenna

    ReplyDelete

  15. Thanks for sharing an article like this. The information which you have provided is better than another blog.
    ergorelax review

    ReplyDelete
  16. Thanks for sharing your thoughts, this blog is great. Use Full Links.
    Video Doorbell Review
    ErgoRelax Review
    AndroidTV Box Review

    ReplyDelete
  17. Nice t0 read such posts.Well, Year of 2019 play a vital role during this international shopping extravaganza, Fastest VPN brings you the best VPN Cyber Monday & black Friday deals. Save much with Fastest VPN mammoth discounts. Stay tuned ….

    ReplyDelete
  18. This Website is great for getting information and conversation. Thanks for sharing with us. like this website so much it's really awesome.I have also gone through your other posts too and they are also very much appreciate able and I'm just waiting for your next update to come as I like all your posts.

    The Other Track
    Echobeat headphone review
    T-Watch Review
    Tactical Watch Review
    Best military watch
    WiFiboost review
    Ecoheat s Review
    Drone X Pro review
    DroneX Pro review
    Photostick mobile review
    The Photostick review
    Photo stick review
    Tactic Air Drone Review
    Mosquitron review

    ReplyDelete
  19. This Website is great for getting information and conversation. Thanks for sharing with us. like this website so much it's really awesome.I have also gone through your other posts too and they are also very much appreciate able and I'm just waiting for your next update to come as I like all your posts.

    The Other Track
    Echobeat headphone review
    T-Watch Review
    Tactical Watch Review
    Best military watch
    WiFiboost review
    Ecoheat s Review
    Drone X Pro review
    DroneX Pro review
    Photostick mobile review
    The Photostick review
    Photo stick review
    Tactic Air Drone Review
    Mosquitron review

    ReplyDelete
  20. This Website is great for getting information and conversation. Thanks for sharing with us. like this website so much it's really awesome.I have also gone through your other posts too and they are also very much appreciate able and I'm just waiting for your next update to come as I likae all your posts.

    The Other Track
    Echobeat headphone review
    T-Watch Review
    Tactical Watch Review
    Best military watch
    WiFiboost review
    Ecoheat s Review
    Drone X Pro review
    DroneX Pro review
    Photostick mobile review
    The Photostick review
    Photo stick review
    Tactic Air Drone Review
    Mosquitron review

    ReplyDelete
  21. What's up, I desire to subscribe for this weblog to take most up-to-date updates, therefore where can i do
    it please help out.the best vpn for china

    ReplyDelete
  22. This comment has been removed by the author.

    ReplyDelete