Security report
SUBJECT
Audit of Hide.me’s no-log policy compliance
DATE19.03.2024 – 06.06.2024
LOCATION
Poznan, PolandGdansk, PolandAUTHORSPaweł RóżańskiMaciej Szymczak
VERSION
1.0+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

1

Executive summary
This document is a summary of the work performed by Securitum during the audit. The aim of the audit wasto verify the compliance with Hide.me’s declared no-log policy, which states that no sensitive data is storedin logs on VPN containers.
The scope of the audit included the following questions:••••••••Is user’s activity tracked on VPN servers handling traffic?
Are DNS traffic or similar logs stored on VPN servers?
Do VPN servers monitor or log traffic?
Is there any monitoring or logging of the services used by user present on servers?
Is there any monitoring or logging of the services used by specific VPN server?
Is there any process to detect unauthorized configuration changes (for example enabling logging)? Is
an automatic alert triggered?
Is logging enabled in the VPN configuration files?
Is the information about which VPN server the user is currently connected to logged?

The audit was based on the:••••••

threat modelling with focus on user’s privacy,
high level review of the no-logs policy,
technical audit of the VPN configuration files,
interviews with the Hide.me team,technical audit of the snapshot of an example LXC container provided by Hide.me,
review of the deployment process of the VPN servers.

During the audit, the Hide.me team was cooperative and answered all questions of Securitum in detail.
The analysis of the example LXC container with VPN services delivered by Hide.me was recognised as
sufficient, as all VPN servers are deployed from the same container image, one for each IP address. The only
differences between the VPN nodes are hostnames, IP addresses and roles of the containers, which serve as
variables for the configuration generation of the services.
As a result of the audit, it was confirmed, that declared by Hide.me no-logs policy is indeed applied, andthe audit did not reveal any issues on VPN container that could lead to a compromise of user privacy.

The only log file found on the container image was the VPN server log file, which is automatically createdduring the start of the VPN daemon and contains information about the start of the process start. It does notcontain data related to user’s activity or traffic.
It needs to be emphasised that this audit refers to the state of Hide.me product as of 15.03.2024, and that
periodic audits may need to be performed to ensure an unchanged level of user data protection in thefuture.

+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

2

The purpose of this report is not to describe all the technical mechanisms and software configuration toachieve the no-log policy, but to present how it was audited for possible incompatibilities with the no-log
policy and present general conclusions.

+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

3

Contents
Security report ......................................................................................................................... 1
Executive summary ................................................................................................................. 2
Change history ......................................................................................................................... 5
Audit conclusions .................................................................................................................... 6
Is user’s activity tracked on VPN servers handling traffic? .............................................................. 7
Are DNS traffic or similar logs stored on VPN servers? .................................................................... 7Do VPN servers monitor or log traffic? .............................................................................................. 7Is there any monitoring or logging of the services used by user present on servers? ..................... 7Is there any monitoring or logging of the services used by specific VPN server? ............................ 7Is there any process to detect unauthorized configuration changes (for example enablinglogging)? Is an automatic alert triggered? ........................................................................................ 8Is logging enabled in the VPN configuration files? ........................................................................... 8Is the information about which VPN server the user is currently connected to logged? .................. 8+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

4

Change history
Document date

VersionChange description

07.06.2024

1.0

Creation of the document.

+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

5

Audit conclusions+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

6

Is user’s activity tracked on VPN servers handling traffic?
Hide.me does not track user’s activity on the VPN servers. No tools, processes or log files were found that
could indicate any form of tracking user’s activity.

Are DNS traffic or similar logs stored on VPN servers?
No evidence was found of DNS traffic or metadata being logged in any way on the VPN server. The DNS server
running on the VPN server has syslog logging explicitly disabled. There is no separate log file for DNS service.
Manual inspection confirmed that logging of DNS queries, responses or cache hits is not enabled in the DNS
server configuration file.

Do VPN servers monitor or log traffic?
Analysis indicates that there is no traffic inspection happening on the sample VPN server provided byHide.me.
However, scripts using iptables and the nDPI library have been found on the container. Although currently
inactive due to script logic, they are still present on the LXC container, and have therefore been analysed. The
packet inspection they performed was only used to determine if the traffic belonged to the bittorrent protocol.
This data was only used locally, to block matching bittorent traffic with iptables. It is common practice toclassify the bittorent protocol in this way. In our opinion, such automatic classification using packet inspection
for the purpose of blocking certain types of traffic does not pose a threat to user’s privacy.

Is there any monitoring or logging of the services used by user present on servers?
There is no sign of this type of activity being performed on VPN servers. The only activity similar to service
monitoring is based on IP packets metadata such as IP address, port or protocol and used in generic iptablesrules, without attribution to specific user. This data is only ephemeral, stored in RAM, and is not stored to any
log files on the container.

Is there any monitoring or logging of the services used by specific VPN server?
There is no evidence of such activity being logged on VPN servers. There are present exceptions for handlingspecific types of traffic. This activity is performed automatically and based on IP packets metadata such as IP
address, port or protocol and is used, together with server role, in generic traffic management rules which arenecessary for the operation of the VPN service. This data is ephemeral, stored in RAM.

+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

7

Is there any process to detect unauthorized configuration changes (for exampleenabling logging)? Is an automatic alert triggered?
No such process was found during the audit and no alarm mechanism was found. However, it should be noted,that another mitigation for unauthorised configuration changes is present. The container deployment process
is semi-automatic. Configuration files are automatically created by scripts, and the templates used to create
them are mounted as read only. Also, directories crucial to the start of services are unmounted after services
have been successfully started. Therefore, changes to the configuration require changes to the master image
and redeployment of the LXC VPN container. In addition, it is not possible to restart services critical to VPN
node operation without restarting the entire system (container).

Is logging enabled in the VPN configuration files?
Logging is generally disabled on containers. No OS kernel logging is enabled. System level logging solutions
such as syslog or journald are also disabled. No logging attempts were found in iptables scripts.
Packet logging is not enabled in the SoftEther VPN server configuration file. However, the server process itself
creates log files with generic messages about its start during service start. This is the default behaviour and,according to documentation, there is no option available in the configuration file to change it. The content of
this log is only related to the operation of VPN process and does not contain any data about traffic or users. In
our opinion this log does not pose a threat to user’s privacy.

Is the information about which VPN server the user is currently connected tologged?
No such information was found in the logs on supplied LXC container image. However, it should be noted, that
this information is necessary to be known to the processes providing VPN services, at least for the time of theVPN session establishment. This data is only ephemeral, stored in RAM, and it is not stored to any log files on
the container.

+48 (12) 352 33 82

www.securitum.pl

securitum@securitum.pl

www.sekurak.pl

8