#Tunnelbear android
#Tunnelbear software

вЂњAfter undergoing the first challenging security test which ended with several critical & high severity findings, the TunnelBear team seems to have redoubled efforts on security.вЂќ

#Tunnelbear software

вЂњThe progress made by TunnelBear over the course of half a year demonstrates how the potential of a security audit and advice in the VPN realm may be harnessed to hoist up the safeguarding strategies within the entire software compound,вЂќ Cure53 said in a summary report. Cure53 also identified four medium, three low severity, and five informational issues.ДЄll vulnerabilities have been patched by TunnelBear only some of the findings rated вЂњinformationalвЂќ remain unaddressed. This time, no critical vulnerabilities were discovered.Д®xperts did find one high severity bug that could have been exploited by an attacker with direct access to the server to obtain files containing sensitive information. Six months later, after TunnelBear worked on improving the security of its product, Cure53 conducted another assessment. Testers also discovered 13 medium, 8 low and 13 informational issues during the initial audit.

#Tunnelbear android

The Android app could have been caused to crash and lose the connection. The API weaknesses allowed cross-site request forgery (CSRF) attacks that could be used to cancel subscriptions, and phishing attacks via invite emails. The browser extension also allowed attackers to force victims into making requests with the VPN disabled.ДЄs for the macOS client, it was affected by a vulnerability that could allow local root privilege escalation via a malicious application installed on the host.Дuring the 2016 testing, Cure53 also discovered three high severity flaws affecting the TunnelBear API and Android application. In both cases, testers had access to servers and source code.ДЄ significant number of serious vulnerabilities were uncovered in the initial tests, including three critical flaws affecting the browser extension and the macOS client.Д®xperts discovered that the browser extension VPN could easily be turned off by getting the targeted user to access a specially crafted webpage. Two separate audits were conducted: one in late 2016 and one in the summer of 2017. Germany-based security firm Cure53 has analyzed the entire TunnelBear infrastructure, including servers, clients, browser extensions and website. TunnelBear has commissioned a third-party audit of its virtual private network (VPN) application and only a few vulnerabilities have been found in recent versions of the product.