Free VPN and its hidden cost: Your may be a stranger’s exit door

Hyderabad: Plenty of people use a free VPN to get around blocked websites or to stay safe on public Wi-Fi. But a notice issued by the US Federal Bureau of Investigation (FBI) earlier this year warns that some of these apps may quietly turn your phone or computer into part of a “residential proxy” network.

That lets strangers send their internet traffic through your connection. If the traffic is criminal, it can look as though you were behind it.

What is a residential proxy?

A residential proxy is a go-between. It lets someone use the internet through another person’s connection, borrowing the IP address of an ordinary phone, computer, streaming box or home router. To the websites on the other end, the traffic looks like it is coming from a regular household.

The FBI says criminals use such networks to hide who they are and where they are operating from.

How a free VPN can sign you up

According to the FBI notice, some free VPN services add users’ devices to these networks without asking for their consent. The details, when disclosed at all, are often buried in the terms of service, which few people read before installing an app, or written in language that is hard to follow. 

One tap on “agree” can be enough to let strangers’ traffic pass through your connection.

Siasat.com checked two popular free VPNs. One says on its own help page that free users share their device resources with a peer network. The other’s terms of service contained no such wording. Neither finding, on its own, tells you whether an app is safe to use.

Why it matters

Once your device is part of such a network, other people’s online activity shows up under your IP address. The FBI warns this can make you appear responsible for things you never did. The notice lists phishing, creating fake accounts and brute-force attempts to break into online accounts among the ways criminals use these networks.

Free VPNs are not the only way in. Some proxy services pay app developers for every download if they build in a software kit that routes traffic in the background. “Passive income” apps pay people to share their internet bandwidth, often without making clear that criminals may end up using it. In other cases, there is no consent at all.

The FBI also warns that streaming boxes promising free sports, shows and films may contain malware or hidden backdoors, and that some internet-connected gadgets come from the factory with malware already installed. Pirated software, games, movies and torrent downloads can carry malware that turns a device into a proxy.

Big networks taken down

The threat is not a small one. On July 2, Google said it had worked with the FBI, US telecom company Lumen and others to disrupt NetNut, a residential proxy network also known as Popa. The network was estimated to run on more than 2 million hijacked devices, including smart TVs and streaming boxes. The action followed Google’s move against another large proxy network, IPIDEA, in January.

Google has warned that a hijacked device does not just put its owner at risk: attackers can use it to reach other devices on the same home network.

How to protect yourself

Be careful before downloading free VPN apps, and avoid dodgy streaming sites, pop-up ads and pirated content. Download apps only from official stores such as Google Play and Apple’s App Store and avoid sideloading apps onto streaming sticks or Android TV boxes.

Keep your phones, computers and other devices updated. Check your home network from time to time for devices you don’t recognise or activity that looks unusual.

If you think a device has been compromised, change your passwords, contact the providers of your accounts and turn on alerts for suspicious logins or transactions. The FBI notes that malware can stay on a device even after the app that brought it in is deleted, or after a factory reset. Antivirus software may clean it; if not, the operating system may need to be reinstalled.

In India, cyber fraud can be reported on the national helpline 1930 or at cybercrime.gov.in.

Get the latest updates in Hyderabad City News, Technology, Entertainment, Sports, Politics and Top Stories on WhatsApp & Telegram by subscribing to our channels. You can also download our app for Android and iOS.