Mozilla introduced its VPN not too long ago, offering users increased online security and the ability to bypass geo-blocks. With numerous alternatives available, both as browser extensions and standalone applications, concerns about the safety of such software that manages browsing data persist. In this article, we delve into the results of a security audit conducted on Mozilla VPN.
To enhance the trustworthiness of their VPN service, Mozilla took the initiative to undergo a security audit—a common practice in the VPN industry. Users often demand proof of a VPN’s security and privacy claims. Given the growing popularity of VPN services, it is imperative to provide users with solid evidence that their virtual private network is genuinely secure and private, free from significant security vulnerabilities that might undermine users’ trust.
Mozilla’s Security Audit of Its VPN
Mozilla enlisted the services of the cybersecurity company Cure53 to conduct a comprehensive audit of its VPN application. The audit encompassed all compatible operating systems to ensure that users across different platforms have access to pertinent information. Following the audit, Cure53 identified 7 vulnerabilities and 8 other issues of varying severity. Among these, two were rated as critical or high, while the remaining 5 received a medium severity rating.
Critical Vulnerability on iOS
The critical vulnerability specifically affected Mozilla’s VPN app on the iOS operating system, sparing other platforms from its impact. This critical bug had the potential to expose the WireGuard private key to iCloud under certain conditions. The high-severity security flaw, on the other hand, had the potential to be exploited by unauthorized extensions, leading to VPN disconnections. The remaining five vulnerabilities, rated as medium severity, posed the risk of exploitation by malicious Android applications and IP address leaks, potentially compromising user privacy and the VPN’s functionality.
These issues collectively represented a significant concern, prompting Mozilla to address them promptly to safeguard user connections.
Resolution of Identified Issues
The primary objective of conducting security audits is to assess the extent of security in place and to rectify any identified problems. Mozilla has successfully resolved all of these vulnerabilities through updates released to users. Does this mean that Mozilla’s VPN is insecure? Vulnerabilities can arise in many cases, but the key is swift resolution, which Mozilla has exemplified.
Our recommendation is to keep Mozilla VPN updated with the latest version and regularly check for application updates to mitigate security risks and access improvements that enhance its performance. This practice should be applied to any software or system, even in the absence of known bugs. In certain instances, Android may not detect new app updates unless they are actively used due to power management settings, making manual updates essential.
Situations Where VPN Usage Should Be Avoided
For the complete Mozilla VPN audit report, you can access it on the official website. This transparency is commendable, as security audit data is typically kept private, with issues addressed behind the scenes to avoid impacting the company’s reputation.
As a general practice, we advise users to regularly check and update their devices, as updates can resolve issues such as websites not loading or programs failing to start. Keeping software and systems up to date is essential for optimal performance and security.