Leaderboard

Hello! Some customers have contacted the support team asking for a comment on the port shadow attack described in CVE-2021-3773 and brought into the spotlight for the umpteenth time during the Privacy Enhancing Technologies Symposium 2024: https://citizenlab.ca/2024/07/vulnerabilities-in-vpns-paper-presented-at-the-privacy-enhancing-technologies-symposium-2024/ To explain why, unlike many other VPN services, AirVPN is not vulnerable to various attacks under the generic port shadow umbrella, please download the new paper and read below while watching table 2 on page 121: in our infrastructure public entry-IP addresses and public exit-IP addresses are not the same (M6). This is an absolute protection against ATIP, connection inference, and port forwarding overwrite and also makes port scan impossible (another reason for which port scan is impossible is given by additional isolation, see the end of the message) per-host connection limit is enforced (M3) making eviction re-route extremely difficult if not impossible static private IP address is implemented (M2) with WireGuard (it can be changed by explicit key renewal user's action) and highly likely with OpenVPN as long as the user connects to the same server with the same key, another (redundant) protection against port scan In our infrastructure additional protections are in place. We prefer not to disclose them all at the moment, we will just mention the block of any communication between nodes in the same virtual network either through private or public addresses. That's why, unlike any corporate VPN with shared resources, you can't contact any service inside the VPN (except the DNS), not even your own, from a machine connected to the same VPN in our infrastructure. Decapsulation as described on the paper is doomed to fail for this isolation/compartmentalization and this is also another reason for which port scans are not possible. TL;DR AirVPN infrastructure, according to the current state of the art in remediation and mitigation by security researchers as well as paper authors, is not vulnerable to the attacks described under the port shadow umbrella in this new paper. Kind regards & datalove AirVPN Staff

We've had that question sometime before but I cannot manage to find the summary anymore.. First, Hummingbird is an AirVPN CLI client based on AirVPN's work for OpenVPN 3 (the current version is 2.6 while 3 is being worked on) and official Wireguard. It can be run standalone with privileges and has a relatively small footprint. Eddie is a full-fledged AirVPN GUI client using either OpenVPN, Wireguard or Hummingbird. So, if you need something to click on, use Eddie. If you are one to type more, use Hummingbird. For completeness' sake, there is also the existence of the AirVPN Suite comprising Bluetit, Goldcrest and Cuckoo, the former of which is a service which connects to AirVPN in the background, controlled via the Goldcrest client, and bundled with the split traffic manager Cuckoo (but it is irrelevant as it's Linux-only as of today).