Latest news with #TCP
Yahoo
5 hours ago
- Yahoo
ExpressVPN patches Windows bug that exposed remote desktop traffic
Engadget has been testing and reviewing consumer tech since 2004. Our stories may include affiliate links; if you buy something through a link, we may earn a commission. Read more about how we evaluate products. ExpressVPN has released a new patch for its Windows app to close a vulnerability that can leave remote desktop traffic unprotected. If you use ExpressVPN on Windows, download version 12.101.0.45 as soon as possible, especially if you use Remote Desktop Protocol (RDP) or any other traffic through TCP port 3389. ExpressVPN announced both the vulnerability and the fix in a blog post earlier this week. According to that post, an independent researcher going by Adam-X sent in a tip on April 25 to claim a reward from ExpressVPN's bug bounty program. Adam-X noticed that some internal debug code which left traffic on TCP port 3389 unprotected had mistakenly shipped to customers. ExpressVPN released the patch about five days later in version 12.101.0.45 for Windows. As ExpressVPN points out in its announcement of the patch, it's unlikely that the vulnerability was actually exploited. Any hypothetical hacker would not only have to be aware of the flaw, but would then have to trick their target into sending a web request over RDP or other traffic that uses port 3389. Even if all the dominos fell, the hacker could only see their target's real IP address, not any of the actual data they transmitted. Even if the danger was small, it's nice to see ExpressVPN responding proactively to flaws in its product — bug bounties are great, but a security product should protect its users with as many safeguards as possible. In addition to closing this vulnerability, they're also adding automated tests that check for debug code accidentally left in production builds. This, plus a successful independent privacy audit earlier in 2025, gives the strong impression of a provider that's on top of things.
Engadget
7 hours ago
- Engadget
ExpressVPN patches Windows bug that exposed remote desktop traffic
ExpressVPN has released a new patch for its Windows app to close a vulnerability that can leave remote desktop traffic unprotected. If you use ExpressVPN on Windows, download version 12.101.0.45 as soon as possible, especially if you use Remote Desktop Protocol (RDP) or any other traffic through TCP port 3389. ExpressVPN announced both the vulnerability and the fix in a blog post earlier this week. According to that post, an independent researcher going by Adam-X sent in a tip on April 25 to claim a reward from ExpressVPN's bug bounty program. Adam-X noticed that some internal debug code which left traffic on TCP port 3389 unprotected had mistakenly shipped to customers. ExpressVPN released the patch about five days later in version 12.101.0.45 for Windows. As ExpressVPN points out in its announcement of the patch, it's unlikely that the vulnerability was actually exploited. Any hypothetical hacker would not only have to be aware of the flaw, but would then have to trick their target into sending a web request over RDP or other traffic that uses port 3389. Even if all the dominos fell, the hacker could only see their target's real IP address, not any of the actual data they transmitted. Even if the danger was small, it's nice to see ExpressVPN responding proactively to flaws in its product — bug bounties are great, but a security product should protect its users with as many safeguards as possible. In addition to closing this vulnerability, they're also adding automated tests that check for debug code accidentally left in production builds. This, plus a successful independent privacy audit earlier in 2025, gives the strong impression of a provider that's on top of things. If you buy something through a link in this article, we may earn commission.
Tom's Guide
a day ago
- Tom's Guide
ExpressVPN fixes a bug which could have disclosed user IP addresses
(Image credit: Olemedia / Getty Images) ExpressVPN has updated its Windows app to patch a vulnerability which could have exposed a user's IP address to observers. As one of the best VPNs, ExpressVPN is very secure but mistakes can happen. The provider said in a blog post that code meant for internal testing "mistakenly made it into production builds." Only users in specific conditions were affected, but the bug meant traffic wasn't being routed through the VPN tunnel as expected – however encryption was not impacted. You may like ExpressVPN acted quickly to fix the vulnerability and is recommending all its Windows VPN users upgrade to the latest version of the app. The code meant for internal testing found its way into production build versions 12.97 to 12.101.0.2-beta. It was reported to ExpressVPN in April 2025 by security researcher Adam-X through the provider's bug bounty program – where security researchers can earn cash rewards for reporting vulnerabilities and flaws. ExpressVPN said its team confirmed and triaged the report within hours. The vulnerability centred around Remote Desktop Protocol (RDP). According to ExpressVPN there was only a risk when an RDP connection was in use or when other TCP traffic was routed over port 3389. ExpressVPN said "if a user established a connection using RDP, that traffic could bypass the VPN tunnel." "This did not affect encryption, but it meant that traffic from RDP connections wasn't routed through ExpressVPN as expected." It added that observers such as internet service providers could see that a user was connected to ExpressVPN and that they were using RDP to access remote servers – information that would ordinarily be protected. RDP is most commonly used in enterprise environments, and therefore most users were unaffected. However ExpressVPN said it considers "any risk to privacy unacceptable." A fix was released five days later in version 12.101.0.45. The researcher confirmed the issue was resolved and ExpressVPN closed the report at the end of June. (Image credit: SOPA Images / Getty Images) How severe could this have been? ExpressVPN analysed the issues and believed "the likelihood of real-world exploitation was extremely low." Given the fact a majority of ExpressVPN users are individuals as opposed to enterprise customers, the provider said "the number of affected users is likely small." For a hacker to exploit the vulnerability, they would've needed to be aware of the bug and find a way to route traffic over port 3389. This could've been done by tricking a user into clicking on a malicious link or compromising a popular website to launch a drive-by attack – all while the user was connected to the VPN. As demonstrated by Adam-X, a user's real IP address could've been revealed. But browsing activity couldn't have been seen and encryption was not compromised. ExpressVPN said it was grateful to its community for notifying it of potential issues and suggesting improvements. The provider will strengthen its internal safeguards to ensure this doesn't happen again.
Arab News
2 days ago
- Business
- Arab News
No bids received for Pakistan's tender for 50,000 sugar metric tons, say traders
HAMBURG: No trading companies were believed to have submitted price offers in the international tender to buy 50,000 metric tons of sugar from Pakistan which closed on Tuesday, European traders said in initial assessments. Traders said the shipment and arrival periods were regarded as having too short notice for realistic offers. The tender from the state trading agency Trading Corporation of Pakistan (TCP) sought loading from August 1-15. The entire volume purchased was sought for arrival in Pakistan by August 30. Pakistan's government had on July 8 approved plans to import 500,000 tons of sugar to help maintain price stability. Market analysts said that retail sugar prices in the country have risen sharply since January.
Business Recorder
2 days ago
- Business
- Business Recorder
Pakistan believed to have received no offers in 50,000 T sugar tender, traders say
HAMBURG: No trading companies werebelieved to have submitted price offers in the international tender to buy 50,000 metric tons of sugar from Pakistan which closed on Tuesday, European traders said in initial assessments. Traders said the shipment and arrival periods were regarded as having too short notice for realistic offers. The tender from the state trading agency Trading Corporation of Pakistan (TCP) sought loading from August 1-15. Pakistan cuts volume sought in sugar tender to 50,000 tons The entire volume purchased was sought for arrival in Pakistan by August 30. Pakistan's government had on July 8 approved plans to import 500,000 tons of sugar to help maintain price stability. Market analysts said that retail sugar prices in the country have risen sharply since January.
