AirVPN and VORACLE? (An attack used to decrypt HTTP traffic sent via VPNs)

[IronConnection 0]

 

"A new attack named VORACLE can recover HTTP traffic sent via encrypted VPN connections under certain conditions.
The attack was discovered by security researcher Ahamed Nafeez, who presented his findings at the Black Hat and DEF CON security conferences held last week in Las Vegas."

 

Nafeez says his VORACLE attack only works against VPN services/clients built on top of the OpenVPN protocol.
The reason is that the open-source OpenVPN protocol uses a default setting that compresses all data before encrypting it via TLS and later sending it via the VPN tunnel —hence satisfying the conditions of the old CRIME, TIME, and BREACH attacks.

 
Source: https://www.bleepingcomputer.com/news/security/voracle-attack-can-recover-http-data-from-vpn-connections/
 
Hello everyone, I've recently read that article above about this new attack called VORACLE that can possibly allow an attacker to recover data from HTTP traffic sent through a VPN.
I've searched these forums for anything mentioning voracle but no results so I'm starting this topic out of interest and concern, and some questions for AirVPN staff.
 
Is AirVPN completely protected from this new attack?
Or is this something that AirVPN needs to *address and what can/will be done, if not why?
What can AirVPN users do against this if anything or what are the exact steps to configure inside Eddie if anything?
 

UPDATE [August 16] An ExpressVPN spokesperson has told Bleeping Computer that their service has also disabled compression to prevent VORACLE attacks.

 
(*With the above quote in-mind does AirVPN need to do the same for its service?)
 
Appreciate any replies and interest in the matter. Thanks.

[Staff 10116]

Hello!

 

The problem does not affect AirVPN, not even if you use a vulnerable browser. AirVPN has not been using compression since around 2013.

 

Kind regards