Page 67 - Cyber Defense eMagazine Annual RSA Edition for 2024

The catalysts for this growth have been the advances in internet bandwidth and the surge in streaming
media. The desire to access video content across borders fueled a demand for VPNs, allowing users to
circumvent geo-based restrictions. The COVID-19 pandemic further accelerated this trend, as users
globally sought VPN services to access content that was otherwise off-limits.

Today, a staggering 1.6 billion people, comprising approximately 31% of the world's internet users, rely
on VPNs to surf the web and access apps pseudo-anonymously. This immense user base has not gone
unnoticed, drawing in entrepreneurs, consumers, and unfortunately, nefarious actors who see an
opportunity to exploit the trend.

The Spectrum of VPN Services: From Benign to Malevolent

With hundreds of VPN services available, the market has become a diverse ecosystem, although many
are owned by the same subset of parent companies. While a considerable portion of VPN usage is used
for legitimate uses, recent incidents highlight the darker side. The credentials of 21 million VPN users
from apps like SuperVPN, GeckoVPN, and ChatVPN have surfaced on the dark web, underscoring the
need for heightened security measures.

As the VPN market matured, providers differentiated themselves with features designed for various levels
of obfuscation and anonymity. These range from simple privacy-focused attributes to sophisticated
features meant for those with a high interest in evading detection. For security and compliance teams,
discerning between these features is crucial to making informed decisions about which VPN traffic to
allow, which to investigate, and which to ban.

A robust threat intelligence solution plays a pivotal role in capturing the diverse features offered by VPN
providers. This insight enables users to distinguish between benign and malicious VPNs, offering a
nuanced understanding of potential risks associated with each.

Decoding VPN Features: A Window Into Security

In understanding the maturity of the VPN market, it becomes evident that not all VPN providers cater to
nefarious players. Major tech giants like Google and Apple offer built-in VPN services with their
subscriptions, primarily for adding location privacy. These services tend to have simpler features, logging
policies, and publish IP address ranges. Despite the security features these companies have already put
in place, malicious actors have already figured out how to use them for fraud.

On the opposite end of the spectrum are VPNs offering features like bulletproof hosting, allowing users
to host content with no oversight and do not respond to law enforcement takedown requests, often
originating from US-sanctioned countries. To navigate this spectrum, security teams need to decipher
the potential for VPNs as well as residential proxies to support nefarious activities through features that
align with malicious intent.

67