bodyType

customContents

entityId

printArticlePageQuery

filter

article

body

urlAlias

articleSectionsContent

articleSeoArticle

articleSourceHeaderArticle

contentSchemaRenderContent

contentSubHeadlineContent

contentHeadlineContent

mainImagePrintArticleArticle

authorBlockPrintArticleArticle

contentSponsorTagContent

articlePianoPaywallContent

scmpYoutubeContent

hooksTrackPageViewArticle

query printArticlePageQuery(
  $entityId: String!
  $customContents: [CustomContentInput]
  $bodyType: BodyFormatTypeEnum
) {
  article(filter: {entityId: $entityId}) {
    entityId
    body(customContents: $customContents, type: $bodyType) {
      json
    }
    urlAlias
    ...articleSectionsContent
    ...articleSeoArticle_3o8td4
    ...articleSourceHeaderArticle
    ...contentSchemaRenderContent
    ...contentSubHeadlineContent
    ...contentHeadlineContent
    ...mainImagePrintArticleArticle
    ...authorBlockPrintArticleArticle
    ...contentSponsorTagContent
    ...articlePianoPaywallContent
    ...scmpYoutubeContent
    ...hooksTrackPageViewArticle
    id
  }
}

fragment articlePianoPaywallContent on Content {
  __isContent: __typename
  ...hooksPaywallPromiseContent
}

fragment articleSectionsContent on Content {
  __isContent: __typename
  sections {
    value {
      ...helpersCheckIfNewsSectionInFirstIndexSection
      ...entityLink
      name
      id
    }
  }
}

fragment articleSeoArticle_3o8td4 on Article {
  ...hooksArticleSeoArticle
  ...helpersCheckIsPostiesArticle
  ...helpersGetArticleTypeArticle
  entityId
  publishedDate
  updatedDate
  summary {
    text
  }
  subHeadline {
    text
  }
  body(customContents: $customContents, type: $bodyType) {
    text
  }
  keywords
  sections {
    value {
      name
      id
    }
  }
  topics {
    name
    entityId
    id
  }
  urlAlias
  authors {
    name
    id
  }
  images {
    style(filter: {style: "768x768"}) {
      url
    }
  }
  readingTime
}

fragment articleSourceHeaderArticle on Article {
  urlAlias
  ...entityLink
}

fragment authorBlockPrintArticleArticle on Article {
  ...defaultArticleDateContent
  ...authorNamesArticle
}

fragment authorNameAuthor on Author {
  ...entityLink
  name
  entityUuid
}

fragment authorNamesArticle on Article {
  authorLocations
  authors {
    entityId
    location
    ...authorNameAuthor
    id
  }
}

fragment blockquoteQuoteContent on Content {
  __isContent: __typename
  ...contentShareWidgetContent
}

fragment checkersCheckContentContainsStarlingImageContent on Content {
  __isContent: __typename
  topics {
    entityId
    id
  }
}

fragment contentHeadlineContent on Content {
  __isContent: __typename
  headline
  socialHeadline
  ...contentHeadlineTagContent
  ...helpersUseContentSponsorContent
}

fragment contentHeadlineTagContent on Content {
  __isContent: __typename
  ...hooksContentHeadlineTagContent
}

fragment contentNewsletterWidgetContent on Content {
  __isContent: __typename
  topics {
    relatedNewsletters {
      ...helpersMassageToNewsletterItemNewsletter
      id
    }
    id
  }
  sections {
    value {
      relatedNewsletters {
        ...helpersMassageToNewsletterItemNewsletter
        id
      }
      id
    }
  }
  ... on Article {
    relatedNewsletters {
      ...helpersMassageToNewsletterItemNewsletter
      id
    }
  }
}

fragment contentSchemaRenderContent on Content {
  __isContent: __typename
  ...blockquoteQuoteContent
  ...imageContent
  ...inlineWidgetContent
  ...photoGalleryWidgetContent
  ...scmpYoutubeContent
}

fragment contentShareWidgetContent on Content {
  __isContent: __typename
  entityId
  urlAlias
  shortUrl
  socialHeadline
  headline
}

fragment contentSponsorTagContent on Content {
  __isContent: __typename
  ...helpersUseContentSponsorContent
}

fragment contentSubHeadlineContent on Content {
  __isContent: __typename
  subHeadline {
    json
  }
  summary {
    json
  }
  ...contentSchemaRenderContent
}

fragment defaultArticleDateContent on Content {
  __isContent: __typename
  ...hooksArticleDateUtilsContent
}

fragment entityLink on BaseWithApplicationAndUrlAlias {
  __isBaseWithApplicationAndUrlAlias: __typename
  __typename
  entityId
  entityUuid
  urlAlias
  urlRedirect {
    toUrl
    id
  }
  application {
    entityId
    id
  }
  ... on Section {
    fullSectionPath {
      entityId
      id
    }
    parentSection
  }
  ...helpersAppBarVariantBase
  ...helpersApplicationBase
  ...helpersCheckIsPlusArticle
  ...helpersStyleSectionContent
}

fragment helpersAppBarVariantBase on BaseWithApplicationAndUrlAlias {
  __isBaseWithApplicationAndUrlAlias: __typename
  ...helpersCheckIsLiveArticle
  ...helpersCheckIsPlusPage
  ...helpersCheckIsPostiesArticle
  ...helpersCheckIsPostiesPage
  ...helpersCheckIsPostMagazineArticle
  ...helpersCheckIsStyleArticle
  ...helpersSectionContent
  ...helpersStyleSectionContent
}

fragment helpersApplicationBase on BaseWithApplicationAndUrlAlias {
  __isBaseWithApplicationAndUrlAlias: __typename
  ...helpersCheckIsPostiesArticle
  ...helpersCheckIsPostiesPage
  ...helpersCheckIsPlusPage
}

fragment helpersCheckIfNewsSectionInFirstIndexSection on Section {
  name
}

fragment helpersCheckIsAmpEnabledArticle on Article {
  entityId
  types {
    value {
      entityId
      id
    }
  }
  sections {
    value {
      entityId
      id
    }
  }
  disableOffPlatformContent
  sponsorType
  published
  ...helpersCheckIsPlusArticle
  ...helpersCheckIsPostiesArticle
}

fragment helpersCheckIsLiveArticle on Article {
  flattenTypeIds
  liveArticle {
    status
    id
  }
}

fragment helpersCheckIsMainTopicContent on Content {
  __isContent: __typename
  topics {
    entityId
    id
  }
}

fragment helpersCheckIsPlusArticle on Content {
  __isContent: __typename
  ... on Article {
    paywallTypes {
      entityUuid
      id
    }
  }
}

fragment helpersCheckIsPlusPage on Page {
  urlAlias
}

fragment helpersCheckIsPostMagazineArticle on Article {
  sections {
    value {
      entityId
      id
    }
  }
}

fragment helpersCheckIsPostiesArticle on Article {
  sections {
    value {
      entityId
      id
    }
  }
}

fragment helpersCheckIsPostiesPage on Page {
  urlAlias
}

fragment helpersCheckIsStyleArticle on Content {
  __isContent: __typename
  sections {
    value {
      entityId
      id
    }
  }
}

fragment helpersGetArticleTypeArticle on Content {
  __isContent: __typename
  ... on Article {
    types {
      value {
        entityId
        id
      }
    }
  }
}

fragment helpersMassageToNewsletterItemNewsletter on Newsletter {
  entityId
  name
  alternativeName
  description {
    text
  }
  summary {
    text
  }
  homepageDescription {
    text
  }
}

fragment helpersSanitizeArticleTypeEntityIdsArticle on Article {
  types {
    value {
      entityId
      id
    }
  }
}

fragment helpersSanitizeAuthorTypesArticle on Article {
  authors {
    types
    id
  }
}

fragment helpersSanitizedAuthorEntityIdsArticle on Article {
  authors {
    entityId
    id
  }
}

fragment helpersSectionContent on Section {
  fullSectionPath {
    entityId
    id
  }
}

fragment helpersStyleSectionContent on Section {
  fullSectionPath {
    entityId
    id
  }
}

fragment helpersUseContentSponsorContent on Content {
  __isContent: __typename
  topics {
    entityId
    sponsor {
      ...sponsorTagSponsor
      name
      type
      id
    }
    id
  }
  ... on Article {
    sponsorType
  }
  ...helpersCheckIsMainTopicContent
}

fragment hooksArticleDateUtilsContent on Content {
  __isContent: __typename
  createdDate
  publishedDate
  updatedDate
}

fragment hooksArticleSeoArticle on Article {
  ...helpersCheckIsPostiesArticle
  ...helpersCheckIsPostMagazineArticle
  ...helpersCheckIsStyleArticle
  ...hooksContentHeadlineTagContent
  ...helpersCheckIsAmpEnabledArticle
  entityId
  headline
  socialHeadline
  types {
    value {
      entityId
      id
    }
  }
  authors {
    entityId
    id
  }
  images {
    generic_og: style(filter: {style: "og_image_scmp_generic"}) {
      url
    }
    styles(filter: {styles: ["og_image_posties_article", "og_postmag", "og_image_style", "og_image_scmp_analysis", "og_image_scmp_explainer", "og_image_scmp_editorial", "og_image_scmp_fact_check", "og_image_scmp_debate", "og_image_scmp_live", "og_image_scmp_obituary", "og_image_scmp_opinion", "og_image_scmp_review", "og_image_scmp_series", "og_image_scmp_generic"]}) {
      url
      style
    }
    type
  }
  urlAlias
}

fragment hooksContentHeadlineTagContent on Content {
  __isContent: __typename
  __typename
  ... on Article {
    types {
      value {
        name
        entityId
        description {
          text
        }
        id
      }
    }
    ...helpersCheckIsStyleArticle
  }
  flag
  sections {
    value {
      name
      id
    }
  }
  ...hooksContentHelperContent
}

fragment hooksContentHelperContent on Content {
  __isContent: __typename
  ...helpersSanitizeArticleTypeEntityIdsArticle
  ...helpersSanitizeAuthorTypesArticle
  ...helpersSanitizedAuthorEntityIdsArticle
  flag
}

fragment hooksPaywallPromiseContent on Content {
  __isContent: __typename
  entityId
  ...helpersCheckIsPostiesArticle
}

fragment hooksTrackPageViewArticle on Article {
  entityId
  publishedDate
  headline
  sections {
    value {
      name
      id
    }
  }
  urlAlias
  authors {
    name
    id
  }
  entityUuid
}

fragment imageContent on Content {
  __isContent: __typename
  headline
  ...checkersCheckContentContainsStarlingImageContent
}

fragment inlineWidgetContent on Content {
  __isContent: __typename
  ...contentNewsletterWidgetContent
}

fragment mainImagePrintArticleArticle on Article {
  images {
    title
    url
    isSlideshow
    size_652x446: style(filter: {style: "652x446"}) {
      url
    }
  }
}

fragment photoGalleryDialogContent on Content {
  __isContent: __typename
  __typename
  ...contentShareWidgetContent
}

fragment photoGalleryWidgetContent on Content {
  __isContent: __typename
  ...photoGalleryDialogContent
}

fragment scmpYoutubeContent on Content {
  __isContent: __typename
  entityId
  urlAlias
  publishedDate
}

fragment sponsorTagSponsor on Sponsor {
  name
  type
  images {
    url
  }
}


sections

types

disableOffPlatformContent

sponsorType

published

headline

socialHeadline

authors

images

publishedDate

updatedDate

summary

subHeadline

keywords

topics

readingTime

authorLocations

entityUuid

Masha Borak

Following the implementation of a new national security law in Hong Kong this month, the city saw a surge of interest in virtual private networks (VPNs). But while many are turning to VPNs to protect their privacy, some could actually be putting user privacy in danger.
Cybersecurity researchers recently announced that they discovered a group of free VPN apps that left their server completely open and accessible, exposing private user data for anyone to see.
The vpnMentor research team, led by Noam Rotem, said in a report published Wednesday that the database held private information about the apps’ users. The database included email addresses, clear-text passwords, IP addresses, home addresses, phone models, device IDs and other technical details. The apps UFO VPN, Fast VPN, Free VPN and Super VPN were among several named in the report.
VPNs are commonly used for a variety of reasons. In China, it’s the go-to tool for avoiding the Great Firewall that blocks access to sites like Facebook and Google. Some people might also use it to secure their web traffic on public Wi-Fi or get around geographic restrictions on streaming sites like Netflix.
The story of China’s Great Firewall, the world’s most sophisticated censorship system
VPNs work by hiding a user’s real IP address while encrypting and re-routing internet traffic through another location. Interest in VPNs has been rising around the world and usage surged during the Covid-19 pandemic as people were forced to work remotely. But VPNs don’t always protect people in the ways they think.
“VPNs are not meant for anonymization, but they do provide some kind of privacy protection against mass surveillance systems,” said Rotem. “In some countries it is illegal to access certain materials that go against government policies or beliefs, and VPNs allow users to bypass these restrictions.”
In Hong Kong, NordVPN is now among the top 20 most downloaded free apps on Google Play. ExpressVPN is also in the top 35. (Neither app was among those accused of data breaches in the report.) Hongkongers have become increasingly interested in VPNs as they seek to scrub their digital footprints, deleting posts from social platforms and switching to secure apps like the encrypted messaging app Signal. It comes amid a new national security law from Beijing that went into effect this month and targets a wide range of acts that could be interpreted as supporting treason, secession, sedition and subversion.

The apps highlighted by the researchers also have a connection to Hong Kong: Researchers claim that they all share the same Hong Kong-based developer. The apps allegedly share the same server and process their payments through a company called Dreamfii HK Limited. The vpnMentor team believes the apps were created by one entity and rebranded for use under multiple names.
Abacus contacted four of the named VPN providers and Dreamfii for comment. When reached through LinkedIn, director of Dreamfii Mengyu Wang said the products we mentioned have nothing to do with the company and didn’t elaborate further. UFO VPN lists Dreamfii as an affiliated company on its website.
UFO VPN and Fast VPN sent almost identical replies, saying the Covid-19 pandemic caused personnel changes that led to bugs in the server’s firewall. The problem has been fixed, they added, noting that the passwords left uncovered in the database were not the same passwords used for logging into accounts. UFO VPN added that it has no users in Hong Kong.
Massive spying on users of Google’s Chrome shows new security weakness
Fast VPN also said that all collected information found on the server is anonymous. The emails collected were sent by users to provide feedback and belong to less than 1 per cent of users, the company said.
Other VPN providers did not respond to our emails.
Rotem and his team say the uncovered database compromised the safety and security of users. The team added that the breach could have affected many users, as the apps have more than 20 million downloads on Google Play and Apple’s iOS App Store.
Rotem also said the risks from the security breach could have troubling consequences. These could include exposing users to malware, phishing or identity theft – or something worse in some countries. The research found data from users accessing adult content in Iran, where this could lead to a prison sentence.
Cyber spies use LinkedIn to hack European defence firms
“By exposing the users' data, UFO VPN literally put lives in danger,” Rotem said.
UFO VPN did not respond to Rotem’s allegation. When we called the office building listed on UFO VPN’s website, the building management said they didn’t have a company by this name in their register.
As VPNs have become more popular, app stores have been filling up with various offerings to meet demand. But it’s not always clear which tool to pick when it comes to cybersecurity.
“Like everything else in the privacy realm, it all comes down to trust,” Rotem said. “Find a solution you trust, look at the company behind it, see if there is a proven track record for not providing logs to official requests, and then you can sleep a little better at night knowing your activities are not monitored.”


Researchers raise privacy concerns over free VPN apps after finding exposed user data

App stores have been filling up with both free and subscription-based VPN apps, but some have been found to endanger user privacy. Photo: Shutterstock

UFO VPN is a free VPN based in Hong Kong and affiliated with Dreamfii HK Limited. (Picture: UFO VPN)

Abacus

Tech


Cybersecurity researchers from vpnMentor say exposed data includes emails, passwords and more
The free VPNs left users exposed to malware, identity theft and potentially worse, researchers say



Four VPN apps tied to a company in Hong Kong could have exposed users to malware, identity theft or worse


Researchers raise privacy concerns over free VPN apps after finding exposed user data

Cybersecurity researchers from vpnMentor say exposed data includes emails, passwords and more The free VPNs left users exposed to malware, identity theft and potentially worse, researchers say

Cybersecurity researchers from vpnMentor say exposed data includes emails, passwords and more

The free VPNs left users exposed to malware, identity theft and potentially worse, researchers say