Instructor: In the previous lecture, 2 2
we discussed a good solution 3 3
to protect us from man-in-the-middle attacks. 4 4
And that solution was to use HTTPS Everywhere plugin. 5 5
With this plugin, as seen earlier, 6 6
we were able to force all HTTPS websites 7 7
to always load over HTTPS. 8 8
Therefore, if anybody intercepts our data, 9 9
it will be useless because it will be encrypted with HTTPS. 10 10
So this solution is really good, it's free. 11 11
The only problem is, as you know, 12 12
it only works with websites that use HTTPS. 13 13
So we seen earlier if you log in or use the HTTP website, 14 14
your data is still exposed, 15 15
hackers or anybody that intercepts your data 16 16
is still able to read your usernames, your passwords, 17 17
or inject JavaScript code, 18 18
serve you fake updates, and so on. 19 19
Also, as seen earlier, with this plugin, 20 20
the hacker or anybody that intercepts your data 21 21
will be able to see the websites that you visit. 22 22
Not only that, but they'll also be able 23 23
to manipulate DNS requests, and therefore, 24 24
they will be able to run DNS spoofing attacks. 25 25
At the end of the previous lecture, I said, 26 26
if you want to take your security to the next level, 27 27
then you should think about using a VPN. 28 28
Let me show you what happens when we use a VPN, 29 29
and then I'll explain it in more details 30 30
to help you understand what's happening. 31 31
So I'm back here at my hacker machine. 32 32
As you know, it's already the man-in-the-middle, 33 33
I'm gonna clear the screen. 34 34
And I'm actually gonna even turn off HTTPS Everywhere. 35 35
Now, it's a good idea to use both at the same time, 36 36
but I'm just gonna turn it off 37 37
just to show you the difference. 38 38
You can use any VPN provider you want, 39 39
it really doesn't matter, 40 40
most of them use more or less the same technologies. 41 41
We at zSecurity provide our own VPN service called ZSVPN, 42 42
so I have it right here, it comes with no logs. 43 43
We support all operating systems, Linux, Windows, OS X, 44 44
Android, and iOS, and even Tails, 45 45
which is a privacy focused Linux Distro. 46 46
So like I said, you can use anything you want, 47 47
they all use more or less the same technology. 48 48
What I wanna highlight right now is what happens 49 49
when you actually go ahead and use a VPN. 50 50
So I'm gonna open my client, 51 51
and I'm gonna connect to a server, 52 52
one of the servers right here. 53 53
And what this will do is, 54 54
it will establish an encrypted tunnel between my computer 55 55
and the VPN server that I just connected to. 56 56
Therefore, right now, let me show you let's just start, 57 57
I'll delete everything. 58 58
And let's start by going to some websites, 59 59
for example, we'll go to google.com, 60 60
then we'll go to bing.com. 61 61
And then let's go to Stack Overflow 62 62
and make sure it loads over HTTPS. 63 63
Now, keep in mind, I am not using HTTPS Everywhere. 64 64
But you'll notice that it will still load over HTTPS, 65 65
as you can see, we're not able to downgrade it. 66 66
And let's take this even one step further, 67 67
let's go to vulnweb.com, and just login. 68 68
So again, this is a website that only uses HTTP, 69 69
it simply does not support HTTPS. 70 70
But let's log in and see if we can still capture the data. 71 71
So I'll just put my password now 0987654321, Log In. 72 72
And let's go back to our Kali machine 73 73
to see if we detected anything. 74 74
Now as you can see, 75 75
we're not able to read any of the traffic 76 76
sent to and from the target. 77 77
So with the case when we used HTTPS Everywhere, 78 78
we were able to see at least, the domains, 79 79
the websites that the targets visited. 80 80
And we were able to see data sent over HTTP 81 81
when we logged in to vulnweb.com. 82 82
But in this case, as you can see, right now, 83 83
we can't see the username and the password, 84 84
even if they're sent over HTTP to vulnwebweb. 85 85
And we can't see the domain names that the target visited. 86 86
And the reason for this is because we are using a VPN, 87 87
and like I said, a VPN creates an encrypted tunnel 88 88
between our computer and a server, and all of our data 89 89
will be sent through this encrypted tunnel. 90 90
Let me explain this to you with diagrams to make it simpler. 91 91
So in general, let's say you try to go to google.com, 92 92
your connection will pass through a number of hubs, 93 93
but at the end, it's going directly to google.com. 94 94
Hence the red arrow indicating that this connection 95 95
could possibly not be encrypted. 96 96
Therefore, your data might be at risk. 97 97
Now when you use a VPN, 98 98
you connect to a VPN server in a certain country. 99 99
And when you do that, you create an encrypted tunnel 100 100
between your computer and the VPN server. 101 101
So let's say you want to go to google.com, 102 102
data request will first be sent to the VPN server, 103 103
now the VPN server will be able to read this, 104 104
but the data is sent in an encrypted tunnel. 105 105
Therefore, if anybody intercepts this data, 106 106
they will not be able to see 107 107
what you are sending to your VPN server. 108 108
That's why we don't even care 109 109
if someone manages to intercept our connection 110 110
because our data is simply gonna be gibberish to them 111 111
as you can see in here. 112 112
Then, once the VPN server receives your request, 113 113
it will forward it to the destination 114 114
that you're requesting, 115 115
and the response will follow a similar route. 116 116
Now, because of this structure, 117 117
because of the way that the data is always encrypted 118 118
between you and the VPN server, 119 119
using a VPN can be useful in so many scenarios, 120 120
because it adds an extra layer of encryption. 121 121
Therefore, it improves our privacy and anonymity in general, 122 122
it allows us to bypass censorship 123 123
because let's say your internet service provider 124 124
is preventing you from accessing certain services, 125 125
or certain websites, they will not be able to know 126 126
what these websites and these services are, 127 127
because again, the connection is encrypted, 128 128
and they won't even know what you're doing. 129 129
All they'll see is that you're connecting 130 130
to a server in some country. 131 131
And last but not least, it'll also protect us from hackers, 132 132
or anybody that intercepts our connection, 133 133
again, because all of our data is encrypted, 134 134
therefore, we don't really care 135 135
who intercepts this data, the data will be gibberish. 136 136
Now, also because of the structure, 137 137
you need to be careful when you pick a VPN provider, 138 138
because this structure introduces the VPN provider 139 139
as a man-in-the-middle, so as you can see, 140 140
we send everything to the VPN server first, 141 141
and then it goes to the internet. 142 142
And the VPN server is able to decrypt this data 143 143
because the tunnel, the VPN encryption, 144 144
is only used between our computer and the VPN server. 145 145
So if the admin of the VPN server 146 146
wanted to analyze your data, 147 147
and see what you sent and received, 148 148
they will be able to do that. 149 149
Therefore, you need to make sure 150 150
that you pick a reputable VPN provider, 151 151
a company that you can trust. 152 152
You wanna stay away from free providers, 153 153
because providing a VPN service is very expensive. 154 154
Therefore, if someone's able to give it to you for free, 155 155
they must have another angle, 156 156
or another reason of why they are giving this for free. 157 157
You wanna make sure that the VPN's provider keeps no logs, 158 158
and with all of that, 159 159
you can use HTTPS Everywhere plugin with the VPN. 160 160
If you do that, you will actually fix the problem 161 161
of the data leaving the VPN server 162 162
because your data will be encrypted 163 163
between your computer and the VPN server 164 164
with two layers of encryption. 165 165
First using the VPN encryption, 166 166
and second using TLS because of HTTPS Everywhere. 167 167
Then data leaving the VPN server 168 168
will be encrypted with one layer of encryption, 169 169
which is the encryption enforced by HTTPS Everywhere. 170 170
Therefore, even though the VPN provider 171 171
is able to see your data, 172 172
and able to decrypt the encryption used in the VPN tunnel, 173 173
they will still not be able to see your data 174 174
because it will still be encrypted with TLS. 175 175
So this basically solves the problem 176 176
of the VPN server being able to see your data, 177 177
because at the VPN server, 178 178
your data will still be encrypted with TLS. 179 179
So to summarize the two methods 180 180
that we covered to protect our data 181 181
from man-in-the-middle attacks, 182 182
with HTTPS Everywhere, it's great, it's free. 183 183
The only problem is it only works with HTTPS websites, 184 184
the person intercepting the data 185 185
will still be able to see the websites we visit, 186 186
and they will still be able to run DNS spoofing attacks. 187 187
Then we spoke about using a VPN. 188 188
And with using a VPN, everything gets encrypted, 189 189
so that's even better. 190 190
None of the attacks that we talked about, 191 191
and that we covered in this course will work 192 192
'cause everything gets encrypted. 193 193
The only problem is, it's not free. 194 194
There are free services, but like I said, 195 195
they're not great, so you shouldn't use them, 196 196
just don't Use a VPN if you don't wanna pay for it. 197 197
The other problem with the VPN 198 198
is that the VPN provider can see your data, 199 199
so you're introducing a man-in-the-middle. 200 200
But we can take this one step further 201 201
and use HTTPS Everywhere with a VPN, and with that, 202 202
we're getting all of the benefits of using a VPN. 203 203
So everything gets encrypted, 204 204
protect us from all man-in-the-middle attacks, 205 205
but without the problem of the VPN provider 206 206
being able to see our data 207 207
because our data will be encrypted with two layers. 208 208
Therefore, even the VPN provider 209 209
will not be able to see what we sent or received 210 210
because it will still be encrypted with TLS. 211 211
So the only downside to using HTTPS Everywhere with a VPN 212 212
is the fact that you have to pay for the VPN service.