Hola is a VPN provider that purports to offer its users freedom from censorship, a way to access geoblocked content, and anonymous browsing. The service claims that more than 47 million people are part of its peer-to-peer network. But according to a group of researchers (calling themselves Adios), it's dangerously insecure: the client software has flaws that allow for remote code execution and features of the client enabled tracking. On top of that, critically, Hola sells access to its peer-to-peer network with little oversight, enabling it to be used maliciously. The nature and scale of problems with Hola has researchers now saying users should bid adieu to the software.
Since the initial reports, Hola has made some changes. One method of remote code execution was removed—though the Adios team says that others remain—and the tracking flaw has also been fixed. But the deeper problems remain, and they're fundamental to the way that Hola is built.
The company doesn't hide the fact that the Hola network is peer-to-peer. Users of the service form a large network, and Hola traffic is routed through this network, using the connections of other Hola users. This is great for Hola; it means that the company doesn't need to operate points of presence in different countries in order to make traffic appear to originate in these countries. But this is very risky for end users.
The example that Adios researchers give is a straightforward one: if you use Hola and someone else uses Hola to distribute child pornography, there's a chance that they'll do so using your Internet connection. This in turn could have the police kicking your door down.
This kind of risk isn't unique to Hola. The Tor network has the same kind of problem: its exit nodes appear to be the traffic source (since that's where traffic changes from being encrypted Tor traffic into regular, trackable Internet traffic), and that can cause liability issues for the operators of exit nodes. This is why the Electronic Frontier Foundation recommends against running an exit node from your home connection.
The difference is Tor exit node operators know what they're doing and choose to take that risk. Hola users, for the most part, don't know the risk exists, and they certainly aren't electing to choose it. Hola does offer a way to prevent your connection being used in this way, however: switch from its free service to its paid one.
Moreover, the company is selling access to its network through an offshoot called "Luminati." The Luminati business is selling bandwidth through an "almost unlimited number of real IP's." This kind of business isn't unique; there are people who sell access to peer-to-peer networks with a large number of IP addresses. They tend to be criminals, selling access to botnets of compromised machines. Access to this kind of network is attractive to, for example, spammers (who want their junk e-mails to originate from as many IP addresses as possible) and those engaging in distributed denial of service attacks (lots of IP addresses means lots of distribution).
It is this paid access that was recently used to attack the 8chan image board. Hola's founder claims that Luminati "screens" users and that the 8chan attacker slipped through. The Adios team found that in practice there were no meaningful restrictions, with a sales representative telling them "[Luminati has] no idea what you are doing on our platform." Anyone willing to pay the price, ranging from $1.45 to $20 per GB, seems to have access to a massive botnet.
While the remote code execution problem, like the tracking problem, could in principle be fixed, problems due to Hola's peer-to-peer nature appear to be intractable. Sending traffic through Hola users' connections is an integral feature of its peer-to-peer network. The Hola network assumes that there are enough users acting as exit nodes; if they were to all go away, the company would have to completely change how its network is built.
As such, the group of researchers is advising that all Hola users remove the software. For those who want to bypass geographic restrictions—a common use for Hola—there are any number of conventional, non-peer-to-peer VPN services out there. For those looking for anonymity online and bypassing of national censorship, the Tor network remains the gold standard.
Listing image by Adios, Hola!
reader comments
78