Context: at work, we have to engage with these ridiculous AI-generated cybersecurity videos, then take a very simple 3-or-4-question quiz to prove our security compliance for the month. Frequently, I find that these videos make outrageous claims. Once, one video made a claim that everything you download from the Google Play and iOS App Stores are completely safe, despite stories like these appearing all the time.
Anyway, the videos we watch frequently make claims that, if you’re on public Wi-Fi, that you must use a VPN, because it obfuscates your devices and traffic from hackers that might be sitting on the network. My question is, does a VPN really protect someone on the LAN side? To my limited knowledge of VPNs, they don’t hide your traffic on the LAN, just the outgoing WAN side when the tunnel punches out. It may help with some MitM attacks, according to this article, but I’m not convinced that a seasoned hacker couldn’t find their way into your device or accounts, even on a VPN, through the local network.
Sorry for the word vomit. I’m also procrastinating!
Yes, it can help protect you from things like https://securityaffairs.com/196017/security/hackers-hijack-hotel-wi-fi-to-steal-microsoft-365-credentials.html
A VPN dos not protect your device. A VPN protects your network traffic because it stops someone on the local network from capturing and manipulating that network traffic. It does not stop someone on the local network from attacking your device directly.
The benefit is minimal. It sounds like someone’s fallen for Nord’s bullshit.
Most of your traffic is already securely encrypted. Https protects the contents, and nearly every site these days is https. Non-website uses are usually similarly encrypted. What a VPN would protect on top of this is the metadata. A sniffer would be able to see that you’re using e.g. Facebook, and how much data in each direction, but not the contents. They might be able to figure out if you’re streaming to Facebook, uploading photos, or simply browsing. They would not be able to identify your account, unless there was another serious breach like installing a new cert.
Of course, all of this is assuming they have successfully activated a usable traffic sniffer, which is NOT a small task.
maybe its more the way they phrase it. a vpn allows you to have a virtual network as if you were on the corp lan and yeah the traffic is encrypted. So in some ways its like you are remot desktopped into a host on the network that has another network connection off the network. If that makes sense.
You have it backwards. The VPN tunnels encrypted traffic (usually including DNS) between your device and the VPN server, so to the LAN operator it just looks like one transport session between you and the VPN. After the VPN the encapsulation is removed and the traffic is unencrypted between the end host and the VPN server.
The primary security benefit of this to your organization is that it allows them to create a firewall rule which restricts access to hosted services to the local LAN, which would include the VPN gateway. That means that only machines with the right certificates and users with the right TOTP authentication can ever access those services, which provides robust protection against phishing and password theft.
The other benefits are that the tunnel masks information about remote network resources like resource URLs and local DNS resolution patterns which might give someone enough information to launch a more sophisticated social engineering attack.
Probably not the DNS unless you’re forcing DNS over http. Otherwise you’ll just be hitting your routers local DNS cache in most cases and it’s not using a VPN, so DNS poisoning is quite possible.
