PureVPN 14.6.0.1

🔐 PureVPN: Recurring Security Questions and Known Issues

1. Has PureVPN ever experienced a security breach?

Yes, PureVPN has faced multiple security incidents over the years.

• January 2023 Breach: A hacker known as "Ninja Defender" exploited vulnerabilities in PureVPN's chat application, leading to a data breach that exposed user emails. The compromised data was later found on Telegram.
  👉 Read more on InsecureWeb

• 2013 WHMCS Exploit: Attackers leveraged a zero-day vulnerability in WHMCS, a third-party CRM used by PureVPN, to breach their systems. This incident led to mass emails falsely claiming account shutdowns and data compromises.
  👉 Read more on ZeroSecurity

2. Did PureVPN compromise its "no-logs" policy by cooperating with law enforcement?

In 2017, PureVPN provided user information to the FBI during a cyberstalking investigation. While the company claimed a strict "no-logs" policy, it was able to supply connection logs that included IP addresses, which were instrumental in the arrest. This incident raised concerns about the extent of logging and the transparency of PureVPN's privacy policies.
👉 Read more on CyberInsider

3. Were there vulnerabilities in PureVPN's Windows client that exposed user credentials?

Yes, in 2018, security researchers discovered two significant vulnerabilities in PureVPN's Windows client (version 5.18.2.0):

• Plaintext Credential Storage: Usernames and passwords were stored in plaintext within the login.conf file, accessible to any local user.
• GUI Exposure: The application's GUI allowed any user to reveal stored passwords without authentication.

These issues were addressed in version 6.1.0, but the initial vulnerabilities highlighted serious security oversights.
👉 Read more on Trustwave

4. Have there been critical vulnerabilities like IP leaks or remote code execution in PureVPN clients?

Yes, researchers have identified critical vulnerabilities in PureVPN's clients:

• DNS and IP Leaks: The Linux client was found to leak DNS requests, potentially exposing users' browsing activities to their ISPs.
• Remote Code Execution (RCE): Under specific conditions, attackers could execute arbitrary code on a user's system via the Linux client.

These vulnerabilities were disclosed responsibly, and PureVPN has since released patches to address them.
👉 Read more on Rafay Baloch's blog

5. Does PureVPN collect user data despite claiming not to?

While PureVPN asserts a "no-logs" policy, it does collect certain user data:

• Connection Logs: Records of the day and the Internet Service Provider (ISP) used to access the service.
• Bandwidth Usage: Monitoring of how much bandwidth a user consumes.
• Account Information: Storage of user email addresses and payment details.

Although PureVPN states it does not log browsing activities or exact timestamps, the data it does collect has been sufficient to identify users in legal investigations.
👉 See Wikipedia summary

6. How has PureVPN responded to these security issues?

PureVPN has taken steps to address and rectify security concerns:

• Patching Vulnerabilities: Following responsible disclosures, PureVPN released updates to fix the identified issues in their clients.
• Transparency: The company has published analyses and responses to certain vulnerabilities, emphasizing their commitment to user security and transparency.
  👉 Read more on PureVPN's Blog

However, some users and experts believe that PureVPN's responses have been reactive rather than proactive, highlighting the need for more rigorous security practices.