This VPN allows anyone to use your internet connection. What could go wrong?

In other posts over the past year, according to Kela’s analysis, cybercrime forum users recommended Big Mama or shared tips about which configurations people should use. In April this year, security company Cisco Talos He said It has seen traffic from Big Mama Proxy, along with other proxies, being used by attackers trying to force their way into a variety of company systems.

Mixed messages

Big Mama has few details about its ownership or leadership on its website. The company’s terms of service state that a company called BigMama SRL is registered in Romania, although an earlier version of the company existed Location from 2022and At least one page is live nowlists BigMama LLC’s legal address in Wyoming. The US-based company dissolved in April and is now listed as inactive, according to the Wyoming Secretary of State’s website.

A person using the name Alex A responded to an email from WIRED about how Big Mama works. In the email, they say that information about free user connections sold to third parties through the Big Mama network is “duplicated in the app marketplace and in the app itself multiple times,” and people must accept the terms and conditions of use. VPN. They say that Big Mama VPN is officially only available from the Google Play Store.

“We do not advertise and have never advertised our services in the forums you mentioned,” the email says. They say they were not aware of Talos’ findings in April that its network was used as part of a cyberattack. “We block spam, DDOS, SSH as well as LAN etc. We log user activity for cooperation with law enforcement agencies,” the email says.

Alex A asked WIRED to send her more details about ads in cybercrime forums, details about Talos results, and information about teens using Big Mama on Oculus devices, saying they would be “happy” to answer more questions. However, they did not respond to any further emails with additional details about the search results and questions about their security procedures, whether they believed someone was impersonating Big Mama to post on cybercrime forums, the identity of Alex A, or who runs the company.

During its analysis, Trend Micro’s Hilt says the company also found a vulnerability within Big Mama VPN, which could have allowed a proxy user to access someone’s local network if exploited. The company says it reported the bug to Big Mama, who fixed it within a week, which was confirmed by Alex A.

Ultimately, Hilt says, there are potential risks when anyone downloads and uses a free VPN. “All free VPNs come with a trade-off between privacy or security concerns,” he says. This applies to people who download it to their VR headsets. “If you are downloading apps from the Internet that are not from the official stores, there is always an inherent risk that they are not what you think they are. This is true even with Oculus devices.