2

I don't know the details of VPN, I always imagine that's a middle point between me and server(internet).

And VPN point always receive my(and from server's) data packets.

So the thing I want to know is "can VPN point be used to do MITM attack?".

I think the VPN provider can get my packets, but is it possible to add something to my data packets and make me get the wrong data from internet?

For example, I'm downloading notepad++ from it's official website with VPN, can VPN provider insert something to the (notepad++)install.exe to make it contain malicious code?

or it's almost impossible?

Hanbi
  • 21
  • 3

2 Answers2

3

VPN provider can manipulate your traffic the same as your ISP can do when no VPN is used. This means blocking, redirecting or modifying traffic, including injecting malware into your traffic. VPN is basically your new ISP in that all your traffic passes through the VPN provider. You just replace the trust in your ISP with trust in your VPN provider. But the VPN provider also has the same limitations as an ISP, i.e. it can not break the additional protection offered by TLS (as in HTTPS).

See also Is using a VPN like changing your ISP? and Can a VPN Provider MitM my SSL traffic without me noticing?.

Steffen Ullrich
  • 190,458
  • 29
  • 381
  • 434
3

Imagine that a VPN is like a teleportation mechanism; instead of the world seeing you surfing the internet from your home, they see you surfing the internet from another point on the planet (i.e. the VPN exit point - most probably the VPN server).

Although this is a simplified version of the reality, it helps you understand that a VPN (at its basic form) all it does is this; nothing more. As such, any attack to which you are vulnerable when you don't use a VPN, you are also vulnerable to when you use a VPN (with some exceptions).

So the thing I want to know is "can VPN point be used to do MITM attack?"

Yes, if you use unenrypted or untrusted encrypted communications between your computer and the servers that you visit (i.e. not the VPN server)

I think the VPN provider can get my packets, but is it possible to add something to my data packets and make me get the wrong data from internet?

For example, I'm downloading notepad++ from it's official website with VPN, can VPN provider insert something to the (notepad++)install.exe to make it contain malicious code?

Yes - see above

or it's almost impossible?

Nope, totally possible with unencrypted (which includes integrity) and unauthenticated communications

Spyros
  • 1,451
  • 1
  • 14