News for hackers. Stuff that matters.

A comment on ProtonVPN. Parent comment

Re:ProtonVPN by boomboomsubban on Tuesday June 20, 2017 @02:01PM (#14596930)
So an installer was trying to set up autoruns, and the outbound connection IP's were on some list? The first part seems like expected behavior, the second sounds like your list of bad IP's included several that one of the most popular VPN providers use.
[ Parent | on HN ]
Re:ProtonVPN by sr2 on Tuesday June 20, 2017 @02:18PM (#14597078)
This was before the client even connected for the first time. And the IPs were well known C&C servers used for collecting keystrokes and screenshots of your O.S
[ Parent | on HN ]
Re:ProtonVPN by boomboomsubban on Tuesday June 20, 2017 @05:33PM (#14598820)
Checking if their various servers exist on install seems likely. And well known C&C servers probably hide their actual IP, they'd be fairly easy to shut down if they didn't.
[ Parent | on HN ]