Mozilla VPN Security Risks Discovered via @sejournal, @martinibuster

Mozilla published the results of a recent third-party security audit of its VPN services as part of it’s commitment to user privacy and security. The survey revealed security issues which were presented to Mozilla to be addressed with fixes to ensure user privacy and security.

Many search marketers use VPNs during the course of their business especially when using a Wi-Fi connection in order to protect sensitive data, so the  trustworthiness of a VNP is essential.

Mozilla VPN

A Virtual Private Network (VPN), is a service that hides (encrypts) a user’s Internet traffic so that no third party (like an ISP) can snoop and see what sites a user is visiting.

VPNs also add a layer of security from malicious activities such as session hijacking which can give an attacker full access to the websites a user is visiting.

There is a high expectation from users that the VPN will protect their privacy when they are browsing on the Internet.

Mozilla thus employs the services of a third party to conduct a security audit to make sure their VPN is thoroughly locked down.

Mozilla VPN Has Strong Security

The security vendor noted in their report that there was a lot that the Mozilla VPN did right, such as the safeguard measures taken for the Linux and MacOS versions, with a special mention of the key management implementation.

Similar observations were made about the Windows implementation, including checking for issues specific to Windows 10 related to DNS leaks but the security vendor, Cure53, found it to be locked down tight.

The security vendor noted:

“In spite of the audit team’s exhaustive approaches, no associated shortcomings were discovered in this regard. The Windows VPN application takes advantage of the system’s credential storage to store authentication data securely.”

Nevertheless, the security vendor noted that there were more security issues discovered with this audit and recommended more resources be devoted for privacy assurance.

They recommended:

“Cure53 would like to draw attention to the increased yield of findings encountered for this examination.

It is recommended that the developer team invest further time and resources into materializing an analysis of all potential attack vectors, particularly when exposing functionality from the VPN client externally.”

Security Risks Discovered

The audit revealed vulnerabilities of medium or higher severity, ranging from Denial of Service (DoS). risks to keychain access leaks (related to encryption) and the lack of access controls.

Cure53, the third party security firm, discovered and addressed several risks. Among the issues were potential VPN leaks to the vulnerability of a rogue extension that disabled the VPN.

The scope of the audit encompassed the following products:

These are the risks identified by the security audit:

The rogue extension issue was rated as high severity. Each risk was subsequently addressed by Mozilla.

Mozilla presented the results of the security audit as part of their commitment to transparency and to maintain the trust and security of their users. Conducting a third party security audit is a best practice for a VPN provider that helps assure that the VPN is trustworthy and reliable.

Read Mozilla’s announcement:
Mozilla VPN Security Audit 2023

Featured Image by Shutterstock/Meilun