Is VPN Needed On Laptops?
By: Robert Lowry
Tags: Computers, Technology, Security, Risk, VPN

If you are a security or technical leader in your company, I’d bet the question comes up from time to time: “is it OK to connect to <random> Wifi networks?”, for example, in a hotel or coffee shop. A typical response is to advise employees “never connect to open wifi” or maybe “use a VPN”.

VPN can mean a few things or be used for different purposes, but for this post’s purposes I am talking about a “full tunnel” configuration. To simplify things, let’s assume a full tunnel sends all network traffic through the VPN before being routed to its final destination. VPN’s primary use for this discussion is to protect the contents of the traffic; not necessarily to reach an “on prem” environment or get an IP address on a particular network. This article assumes the resources you are connecting to do not have IP restrictions and can be accessed from anywhere. Technically speaking, there are multiple types of VPN, but for the sake of discussion here, those details are not important.

Instead of focusing on features of VPN, let’s take a step back and break down the risks and how VPN and TLS protect us as it is related to connecting to a public or “untrusted” wifi connection.

Threats:

Man in the Middle, website manipulation

While actual technical details vary, the VPN generally protects you at the network layer. All network traffic is encrypted at the device/network level so a website viewed on an untrusted network cannot be manipulated. When operating on a network that is presumed to be hostile, tunneling your traffic over a VPN connection ensures a malicious network operator cannot observe or manipulate your traffic.

A TLS connection to a website in Chrome will protect you at the application layer. The secured connection will make it so the content protected by TLS cannot be changed or manipulated. TLS provides confidentiality (encryption and integrity protection of content) as well as client-to-server authentication (so that you can be assured the amazon.com you’re talking to is the real amazon.com). Further, Chrome will give warnings and click throughs if it detects something is wrong with the certificate, an indication of website manipulation.

Man in the Middle, Malware injection

Again, a VPN protects you at the network layer. All network traffic is encrypted at the device/network level so a malicious entity cannot inject malware into your internet traffic or onto a web page you are viewing.

On most computers, Antivirus/malware is typically installed and can provide further protections for malware. Both Windows and Macs have these protections built into their latest operating systems. In addition, Macs typically run as users not admins. Although many employees have admin accounts, the employee would have to enter their password to install something, including malware.

Open Network Snooping

When you are on the same network as others, you may be able to see some network traffic from those people. This snooping tends to be easier if the WiFi has no encryption or if the snooper controls the WiFi hotspot completely. There are different ways and tools to snoop on others on your wifi network. Here is a simple example of how to create your own “malicious” network using Wifi Pumpkin:

https://medium.com/bugbountywriteup/how-i-made-a-fake-access-point-to-harvest-login-credentials-6898efb96b3b

Again, A VPN protects you at the network layer. All network traffic is encrypted at the device/network level. All of the traffic appears that traverses the Wifi network will be going to the same location, the VPN endpoint. A VPN will protect against local network snooping.

Remember, with TLS, a successful snooper would be able to see what sites you are browsing and possibly the URL, but not the content of the pages. The snooper would not be able to modify contents of web pages or urls. In the article sited above, the Wifi Pumpkin is collecting HTTP authentication, not authentication over HTTPS.

Defcon is famous for having a Wall of Sheep. It collects usernames and passwords of people who connect to open and monitored wifi networks; thie information is then posted publicly. https://www.wallofsheep.com/pages/wall-of-sheep. Again, this is collecting authentication over HTTP, not HTTPS.

Most sites today are using HTTPS not only for authentication, but for everything, drastically reducing your risk.

Additional benefits of VPN

Known IP address endpoint for IP whitelisting for corporate resources becomes an option.

Browsing history is hidden from the WiFi provider, the ISP, any snoopers, etc. up until the point of the VPN exit. Browsing history may be harvested and sold by the VPN provider.

A VPN will mask things like your IP address and location to keep them from being tracked by websites, internet browsers, cable companies, internet service providers (ISPs) and others.

Note: No technological barrier prevents the ISP from tracking and logging your online behavior, selling the data to advertisers, or handing it over to the authorities. If your ISP is trustworthy, the government can compel it to give up your browsing history through subpoenas.

Downsides of VPN

Using a VPN will require additional configuration, particularly to make sure it is always working. Should the VPN fail open or closed?

Similar to how your ISP has the ability to snoop on your traffic or profile you, a VPN provider can do the same thing. You must trust your VPN provider, otherwise you are trading one risk for another similar risk. A shady or untrusted VPN service can easily redirect traffic. Particularly, if you are using the VPN’s DNS they can redirect traffic from any site, anywhere they want.

Depending on the VPN provider, a VPN may slow down your internet connection. It depends on your VPN provider and its congestion, very similar to your ISP.

Roberts Remark:

A VPN does have some benefit. Security improvements are probably marginal for most average users connecting to “unknown” or hotspots in hotels or cafes. These days, just about every website uses TLS for site verification and encryption. Google Chrome, which most employees use, has protections against MITM and other TLS attacks providing users with warning and multiple click-throughs when something appears spoofed, compromised, or there is a certificate mismatch.

One argument might be that a subset of users is likely to click through any and all warnings just to get to whatever site they need. Therefore, if there is a desire to further protect employees via a VPN, it is best not rely on said employee to have to remember to turn it on to protect them. If a full tunnel VPN is deployed for protection purposes, we should consider having employees leave it on all the time. This is because these same click-through employees are likely to forget to turn on the VPN.

Do you disagree? Leave a comment.