Hola is a popular virtual private network (VPN) provider that is available for various web browsers including Google Chrome, Mozilla Firefox and Internet Explorer, as well as desktop and mobile operating systems.
It is free to use and if you check ratings and users on Chrome's Web Store alone, you will notice that it is used by more than 7.1 million Chrome users currently.
Hola uses a sophisticated system to offer its services for free. Instead of routing users solely (or at all) through company servers and raking up huge bandwidth bills in the process, it is utilizing user devices as endpoints.
This means basically that any user device that Hola is running on acts as an endpoint. An endpoint is a node that is communicating directly with a target website or service that Hola users access when the service is enabled.
Hola users have no control over endpoints which is problematic for several reasons. First, it increases the bandwidth usage on the device and reveals your device's IP address to the target service or website which you may not always want.
What's even more problematic than that is the fact that Hola seems to have started selling access to these exit nodes on the Luminati website.
If you check Whois records for both sites, you will notice that they are both owned by Hola.
Luminati provides its customers with access to an API that they can use to utilize Hola end points for various activities, for instance denial of service attacks but also load tests. This makes Hola an effective botnet, especially since it cannot be blocked easily as it uses IP addresses from around the world and not a set of larger IP ranges.
The admin of 8chan noticed denial of service attacks recently against the site and found out that the attack was utilizing Hola endpoints through Luminati.
Hola charges per Gigabyte of traffic starting at $20 per Gigabyte and going down to $2 per Gigabyte and lower depending on volume that you purchase.
This means: if you are using Hola, your connection may be used as an endpoint not only by other Hola users who try to access sites in the country you are in, but may also be sold to individuals and companies who may use it for questionable or outright illegal activities.
Update: Hola has posted a response to recent events. You can read it on the official company blog.
Update 2: The blog post is no longer available.
If your computer is being used as an exit node, it is your IP address that webmasters, law enforcement or rights holders see when they check server logs. If it is used in attacks or malicious activity, it is you who will be contacted by the authorities or site owners.
My personal recommendation is to uninstall Hola if it is installed on a system and stay away from the service for now.Advertisement
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.