In recent years, the use of Virtual Private Networks (VPNs) has exploded, fueled by the growing awareness of the need to protect one’s online privacy or by the desire to appear elsewhere in order to access services or more advantageous prices.
A common thought these days is: “Why pay for a VPN when there are so many free ones available?” But are free VPN services really free?
Thus, while many people choose to rely on free VPN services, driven by the promise of anonymity and security, few know the risks that lie behind this choice. A thorough analysis of the sector reveals that reality is far more complex than it seems.
What is a VPN and why it can be useful
A VPN allows internet traffic to be encrypted, hiding the user’s IP address and making it difficult for third parties to monitor their online activity. In an era where digital profiling is constant, this technology presents itself as a lifeline for those who wish to protect their privacy and personal data.
But not all VPNs are the same. While paid services invest significant resources in security infrastructures, free VPNs often do not have the same standards, opening the door to a series of unforeseen dangers.
Free VPNs: threats and issues
The main appeal of free VPNs is evident: the promise of anonymity and geo-relocation at zero cost. However, as social networks have taught us, when the service is free, the real product is you. Free VPN providers must still cover infrastructure costs, and the most common way to do so is through the monetization of user data. Some common practices include:
- Collection and sale of personal data: Contrary to the image of “anonymity” that many expect, several free VPNs collect and store user information, which they then sell to third parties, including marketing companies and data brokers. Instead of protecting your privacy, such services compromise it.
- Invasive advertisements: Many free services insert advertisements inside users’ internet traffic. Not only does this slow down browsing, but it can also open the door to malware and phishing attacks.
- Vulnerable infrastructure: Unlike paid VPNs, which often have secure servers and updated protocols, free VPNs may use obsolete servers vulnerable to cyberattacks. This exposes users to a greater chance of being intercepted or hacked.
- Reduced speeds and limited bandwidth: Free services often impose restrictions on performance, limiting browsing speed and the amount of data that can be transferred. These limits, besides being frustrating, can undermine the effectiveness of a VPN, especially in sensitive contexts such as remote work or financial transactions.
Included for free: participation in a Botnet
One of the most alarming revelations that emerged from recent research published by Kaspersky is that about 38% of free VPN applications for Android contain malicious code, putting the security of users’ devices at serious risk.
In May 2024, the FBI, together with other law enforcement agencies, dismantled a botnet known as 911 S5. This extended over 19 million unique IP addresses in more than 190 countries, which likely made it the largest botnet ever created.
The creators of 911 S5 used various free VPN services to build their creation, in particular: MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. Users who installed these apps saw – unknowingly – their devices turned into proxy servers, channeling someone else’s traffic.
These devices were then used for various illicit activities by the botnet’s users — cybercriminals who paid the creators of 911 S5 to access and exploit it. As a result, the users of these free VPN services became unwitting accomplices in a wide range of crimes: cyberattacks, money laundering, mass fraud, and much more — since their devices effectively became part of a criminal network without their consent.
The 911 S5 Botnet began its operations in May 2014. In 2022, law enforcement had already tried to dismantle it, only to see it reappear a few months later under a new alias: CloudRouter.
Finally, in May 2024, the FBI managed to permanently dismantle the botnet infrastructure, also arresting its creators. During its operation, it is estimated that the criminals who administered it managed to earn about 99 million dollars.
Conclusions
In light of these facts, the crucial question every user should ask is: is it really worth putting one’s data at risk to save a few euros? Free VPNs may seem like a simple and convenient solution, but they often hide pitfalls that can prove extremely harmful to privacy and digital security.
In a world where cybersecurity is becoming increasingly crucial, investing in a reliable, transparent, and paid VPN service is a wise choice. It is not only about protecting one’s connection, but about ensuring that one’s data does not become merchandise in the underworld of an increasingly complex and competitive digital market.
