Submitted 9 months ago by Squire1039@lemm.ee to technology@lemmy.world
Bug:
Affected versions 12.23.1-12.72.0 (May 2022-Feb 2024) with split tunneling feature.
Impact:
Exposed visited domains to user’s ISP, potentially leaking browsing history.
Affected users:
Windows users with active split tunneling (about 1%).
Fix:
Upgrade to version 12.73.0 (removes split tunneling temporarily).
Alternatives:
Disable split tunneling or use ExpressVPN version 10.
Note:
All other traffic and content remain encrypted.
Well people who uses express vpn kinda had it coming to them.
What’s wrong with express?
There are a lot of different things, I suggest to look it up for the accurate details. However the most sketchy thing is that it’s owned by Kape Technologies, previously known Crossrider something… Who helped distribute malware through their frameworks. On top of that, one of the employees have had connections to the UAE, and got caught, but still works there…???
That’s just the gist, and it’s some crazy stuff… Any VPN owned by Kape Technologies you should stay far away from.
Mullvad: “Pathetic.”
ArchAengelus@lemmy.dbzer0.com 9 months ago
Uh, I might be wrong here, but isn’t the whole purpose of split tunneling to allow you to send only necessary traffic through a given tunnel? Then the rest of your traffic goes whatever the default path is?
This seems more like a feature than a CVE. Maybe I’m missing something.
vividspecter@lemm.ee 9 months ago
They might mean it’s happening even with requests routed through the VPN.
Still@programming.dev 9 months ago
so it would be like you say I want Firefox to go thru the tunnel, you would want the DNS requests made from it to go thru as well, in this case they weren’t tunneled and were just going to the normal dns server