Information Technology

Image: CD Projekt Red
Polish game developer CD Projekt Red, the maker of triple-A games like Cyberpunk 2077 and The Witcher series, has disclosed today a ransomware attack.
In messages posted on its official social media channels, the gaming studio said the attack took place yesterday when a threat actor gained access to the company’s corporate network.
“Although some devices in our network have been encrypted, our backups remain intact. We have already secured our IT infrastructure and begun restoring the data,” the company wrote on Facebook and Twitter.
The game maker also published a copy of the attacker’s ransom note, in which the hackers claimed they obtained copies of the source code for games like Cyberpunk 2077, Gwent, and The Witcher 3, along with an unreleased version of The Witcher 3 game.

Image: CD Projekt Red
But despite the threat of a sensitive leak, the game maker said it wouldn’t be paying any ransom demand.
“We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data,” the company said.
“We are still investigating the incident, however at this time we can confirm that —to our best knowledge — the compromised systems did not contain any personal data of our players or users of our services.”

The game maker said it already notified local authorities.
CD Projekt Red now becomes the fourth major gaming studio to fall victim to a ransomware attack over the past 12 months after attacks on Ubisoft and Crytek by the Egregor gang, and the attack on Capcom by the Ragnar Locker gang.
The attacker behind the CD Projekt Red attack has not been yet identified. More

Image: Ukraine Ministry of Internal Affairs
Ukrainian police arrested a 39-year-old man last week on accusations of developing and advertising one of the most advanced and widely used phishing toolkits of the underground hacking scene.
The suspect, whose name was not released to the public, was arrested last week, on Thursday, February 4, in the Ternopil region of Ukraine, following an international investigation between law enforcement agencies in Australia, the US, and Ukraine.
Suspect identified as uPanel author
Sources familiar with the investigation told ZDNet the suspect was the author of a phishing tool named uPanel, sometimes also referred to as U-Admin.
Fred HK, an independent malware security researcher who studied the toolkit in a report last year, described uPanel as the following:
“U-Admin is a control panel for receiving logs from phishing kits, and controlling victim interaction. U-Admin is also used with injections, which are snippets of code that are injected into a victims’ browser, enabling the attacker to gather more information from their victims. […] U-Admin is not sold on its own, it is included when you purchase one of their phishing pages/injects.”

Image of the uPanel store hosted on the dark web.
Image: Fred HK
According to information shared with ZDNet by threat intelligence firm Intel 471, uPanel was sold via a dedicated website hosted on the dark web and advertised on one a popular underground cybercrime forum, where the author went by the nickname of kaktys1010.
According to early versions of the author’s ads, the uPanel kit has been available for sale since 2015, with its price ranging from $80 to $800, depending on the features buyers wanted to have included in their panels.
uPanel had more than 200 customers

In a press release from the Ukrainian Ministry of Internal Affairs last week, officials said that uPanel had more than 200 active customers based on data they obtained after seizing computers, laptops, and smartphones from the suspect’s residence.
Officials believe the uPanel phishing toolkit was used in phishing operations that caused tens of millions of US dollars in losses to financial institutions in 11 countries, such as Australia, Spain, Italy, Chile, the Netherlands, Mexico, France, Switzerland, Germany, the US, and the UK.
Australian law enforcement said that more than 50% of all phishing attacks that targeted Australian users in 2019 were carried out using uPanel.
Investigators said the suspect didn’t just create the phishing kit and advertised but also spent a great deal of time and effort in providing tech support to its customers.
A video released by Ukrainian officials with footage from the suspect’s arrest is available below:
[embedded content] More

Image: ZDNet
Spammers have inundated the Python Package Index (PyPI) portal and the GitLab source code hosting website with garbage content, flooding both with ads for shady sites and services.
The attacks were unrelated to each other.
PyPI flooded with more than 10,000 listings
The biggest of the two attacks took place on PyPI, the official package repository for the Python programming language, and a website that hosts tens of thousands of Python libraries.
For the past month, spammers have been abusing the fact that anyone can create entries on the PyPI website to generate pages for non-existent Python libraries that basically served as giant SEO ads for various shady sites.
The pages usually contained a soup of search-engine-friendly keywords for various topics, ranging from gaming to porn and from movie streaming to giveaways, and a shortened link at the bottom, often leading to a site trying to obtain payment card data, according to ZDNet’s tests.

Reached out comment earlier today, the PyPI team said it was aware of the SEO spam flood.
“Our admins are working to address the spam,” Ewa Jodlowska, Executive Director of the Python Software Foundation, told ZDNet in an email on Monday.

“By the nature of pypi.org, anyone can publish to it so it is relatively common,” she added.
Shortly after the exec’s email, many of the spam listings created on the PyPI portal began to be removed, an operation that appears to be still underway.
GitLab project owners spammed via email
But while the spam attack on PyPI appears to have been going on for at least a month, a new one was detected at GitLab, a website that allows developers and companies to host and sync work on source code repositories.
An unknown threat actor appears to have spammed the Issues Tracker for thousands of GitLab projects with spam content on Sunday and Monday that, each, triggered an email to account holders. Just like the spam on PyPI, these comments also redirected users to shady sites.

Spamming source code repositories appears to be a new tactic for spam groups, which in previous years have usually focused on blogs, forums, and news portals, which have often seen their comment sections flooded with shady links.
GitLab was obviously not prepared for this kind of attack because its email system was overwhelmed and slowed down, with legitimate emails being delayed and queued, according to an incident status report the company published on Monday.

We confirmed that mail latency was caused by a user’s spam attack. Mitigation is in progress, as we drain the offending job processing queues. https://t.co/FRkUs3EQOU
— GitLab.com Status (@gitlabstatus) February 8, 2021

Things are back to normal now, but both incidents show the dangers of leaving systems open and unprotected on the internet.
While spam is not a sexy attack vector, many companies will often fail to secure servers, web apps, and subdomains and will often have these resources abused to either host or participate in spam attacks.
For example, Microsoft, one year later, still has a problem with spam groups hijacking subdomains on its official microsoft.com site to host shady content. More

The Attorney-General’s Department is currently in the midst of reviewing the Australia Privacy Act 1988. Since October, it has been calling for all interested parties to provide their two cents.
A reoccurring theme from many of the submissions has been to align the Act with international laws, such as Europe’s General Data Protection Regulation (GDPR). Facebook, for example, has suggested making such a change would prevent the creation of a “splinternet”. 
Adopting many elements of the GDPR would also provide for a more up-to-date definition of “personal information”, according to many. The Cyber Security Cooperative Research Centre (CSCRC), which is based out of Edith Cowan University in Western Australia, in its submission, called for the definition of personal information to be amended to align with the GPDR. As did Facebook.
AusPayNet submitted [PDF] that the definition of what constitutes personal data as seen in other data protection regulation should be used to reduce uncertainty and ensure the rights and freedoms of Australians are protected.
It said using the term “related to” rather than “about” an identifiable individual would also help.
Microsoft similarly believes [PDF] personal information should be defined in the Privacy Act to include information that relates to an identified or identifiable individual; likewise, DiGi [PDF], the not-for-profit association representing the digital industry in Australia, believes the definition of personal information in the Act should be updated to clarify that it captures technical data such as IP addresses, device identifiers, location data, and any other online identifiers that may be used to identify an individual.  
The Act currently limits the definition of “personal information” to that of an identified individual or an individual who is reasonably identifiable.

The GDPR defines personal data as: “Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental economic, cultural or social identity of that natural person”.
The Human Rights Watch, meanwhile, has encouraged the consideration of the rights guaranteed to individuals under the GDPR, saying in its submission [PDF] many of which should form a fundamental part of a truly modernised Privacy Act.
Recognising a copy and paste of the EU law would not be the ultimate solution, Human Rights Watch added that the GDPR’s “rights of the data subject” section ensures there are clear and actionable rights for individuals. It believes the review of the Privacy Act should seek to provide the same, or similar.
In contrast, the Australian Financial Markets Association (AFMA) said it does not see an overarching need to amend the definition of personal information to expressly include technical information.
“The current definition of personal information does not imply the potential for exclusion of technical information as constituting personal information. We note the current definition is broad in scope, sufficiently so to include technical information to the extent that the information reasonably identifies an individual when combined with other data fields,” the AFMA said in its submission [PDF].
“We submit that it would not be appropriate to extend the definition of personal information to include personal information of the deceased given the well-recognised legal principles already applied in the Privacy Act.”
Fintech Australia, the body representing Australia’s fintech industry, has the interests of its data-hungry members at the forefront, arguing in its submission [PDF] a need for separate frameworks for how data is handled.
It has suggested a “simple framework” that is built to align with the relevant industry, rather than a one size fits all approach that is currently adopted with the principles based privacy regime.
“The overarching goal of the framework system should be to enable the development of a vibrant and innovative data economy in a way that maximises the certainty, transparency, trust and security of individuals to whom the data relates,” it wrote.
With calls for another GDPR mechanism, the right to erasure, coming from many submitters, Fintech Australia said it disagrees with such a concept.
“It is difficult in a practical sense to delete information from all systems; erasing data is not permitted in a lot of cases (such as for anti-money laundering purposes, know your client, and other requirements at law) and so the request may be futile and potentially gives individuals a misleading sense about what they can do with their information,” it said.
“It destroys a valuable resource for our digital economy as it may compromise an aggregated data set used for statistical or analytical purposes.”
MORE FROM THE PRIVACY ACT REVIEW More

Late last week, the government tabled the Commonwealth Ombudsman’s report on agency access to stored communications and telecommunications data for the 2018-19 financial year, and while the Ombudsman was upbeat about most agencies getting better, all agencies fell foul of sticking to the letter of the law in some way.
The irony is that the agencies inspected form the law enforcement arm at federal and state levels. The agencies looked at were Australian Criminal Intelligence Commission, Australian Federal Police (AFP), Crime and Corruption Commission Queensland, Department of Home Affairs, Independent Commissioner Against Corruption for South Australia, New South Wales Police, Queensland Police, Tasmania Police, Victoria Police, and Western Australia Police.
“We identified instances at all inspections in 2018-19 where agencies had accessed telecommunications data without proper authority. As such, the disclosure of the data was unauthorised,” the report [PDF] said in the section dedicated to telco data inspections.
Problems with the authorisations ranged from “administrative error”, such as in incorrect number or time period on a notice, to authorisation being made by those without authority to do so, failing to send written notices as required by law, and relying on oral notices.
“At all agencies, we identified instances where carriers had provided data that was not authorised because it was outside the parameters of the authorisation. This included instances where the carrier provided data that exceeded the time period authorised, or provided a different type of data than was authorised,” the report said.
The Ombudsman said although “many agencies” could identify and quarantine unauthorised data, at around half of the agencies, the inspections found further instances of unauthorised data.
Called out for an elevated level of criticism was Tasmania Police, which the Ombudsman said did not have a “well-developed compliance culture”.

“This was indicated by a large number of issues across several of its processes, including limited progress in addressing our previous inspection findings and significant variances in the level of awareness of requirements under the Act,” the report said.
“We considered that the required improvements could not be implemented without fundamental changes to the way Tasmania Police approaches compliance.”
In the telco data section, Tasmania Police received two recommendation and 10 suggestions, with failures in gaining consent to access data, a lack of record keeping on when communications data is destroyed, failing to destroy data when required, and data being destroyed without proper approval.
“At both the 2017-18 and 2018-19 inspections, we identified that all stored communications a particular carrier provided to Tasmania Police were received by a staff member who was not authorised to receive them,” the report stated.
The inspections also found Tasmania Police had an “ineligible issuing authority” around stored communication warrants.
“We were not satisfied that Tasmania Police had taken appropriate remedial action to manage the unlawfully accessed stored communications or that there was sufficient awareness within Tasmania Police of the existence of these invalid warrants,” the Ombudsman said.
Further, the inspections showed Tasmania Police failed to provide its annual report for 2017-18 to the Minister for Home Affairs, as required.
Previous instances of the report have seen the Department of Home Affairs dressed down for failing to handle stored communications data properly. In this instance, Home Affairs walked away with 11 suggestions in total.
“Over previous inspection periods we identified, and the department has disclosed, serious compliance issues relating to its use of stored communications powers. However, the scale and seriousness of these issues decreased as the department developed and implemented measures to improve its compliance,” the report said.
The department disclosed 74 instances of an unauthorised officer making authorisations for data, and 54 instances where received data was outside the period of the authorisations.
“In each instance, the department’s telecommunications data request system inputted the end time for authorisations as 00:00, rather than 23:59, which meant the period of the authorisation ended at the beginning of the day rather than the end,” the report said.
“While the department sought to address this through manual annotations on the authorisations, in some instances telecommunications data disclosed was dated after the end time of the authorisation and therefore outside of what was authorised,” the report said.
The AFP were handed three recommendations and 33 suggestions as the agency continued to issue successive foreign preservation notices, failed to gain consent of victims in one instance, failed to destroy data, and directed telcos to perform actions that were not required or did not have legal authority to perform.
The report said there were several instances where it could not be confirmed whether authorised officers had made “required considerations” prior to authorisation due to a lack of documentation. It also passed on multiple requests from foreign law enforcement without checking whether the request was permitted in Australia.
“We also identified that the AFP had made two foreign prospective authorisations (one of which had been extended) in the absence of the Attorney-General having made an authorisation … despite this being required before a foreign prospective authorisation can be made,” the report said.
“In our 2019-20 inspection, we found that the AFP was not able to account for the use and disclosure of the information it obtained under one of these authorisations and suggested that it do so.”
The AFP also received a number of stored communications warrants from a member of the Administrative Appeals Tribunal (AAT) that was not authorised to do so. This was a common issue amongst the agencies inspected, as were the issues of warrant templates not being in a prescribed form, and having incorrect wording in affidavits.
Victoria Police was also found to have authorised officers making requests without proper consideration, nor proper training or reference materials. The police force also does not have a system capable of quarantining unauthorised data. Consequently, Victoria Police received four recommendations and nine suggestions.
During the period covered by the report, NSW Police led the way with over 98,000 uses of its powers for historic records, followed by Victoria Police with 82,700, Queensland Police used the powers almost 25,300 times, the AFP used its powers for historic records 19,550 times.
For prospective records, Victoria Police used its powers almost 9,700 times, the AFP was next with 3,700 uses, followed by Queensland Police on 3,430.
Of those records, the Commonwealth Ombudsman only needed to look at 155 records from the AFP, 125 from Victoria Police, and 92 from Tasmania Police to find issues on which to base its report.
Updated at 12:14pm AEDT, 9 February 2021: Clarified number of agencies inspected was ten. Twenty agencies in total have access to stored communications and telecommunications in Australia.
Related Coverage More

Two of the largest social media platforms have asked that the Australian government consider implementing many of the elements present in Europe’s General Data Protection Regulation (GDPR) when refreshing the country’s 33-year old Privacy Act.
In a submission [PDF] to the Attorney-General’s review of the Privacy Act 1988, Facebook called for “effective privacy and data protection” as part of a “globally harmonised framework”. It believes failing to do runs the risk of creating a “splinternet”, where some countries or regions of the world adopt approaches to privacy and data protection that are mutually exclusive to other regimes.  
From 2017: How Europe’s GDPR will affect Australian organisations
To avoid this risk, Facebook has recommended that Australian privacy laws be reformed to make them more aligned with the “best practice privacy frameworks of Australia’s main trading partners and leading digital economies in the world”.
“Ensuring alignment with global norms enhances Australia’s global competitiveness and this type of regulatory harmonisation reduces unnecessary compliance costs and leads to increases in productivity,” it wrote.
Some alignments include changing “personal information” within the Act to “personal data” as defined in the GDPR; adopting “multiple flexible legal bases for using or disclosing data”, similar to the EU process; and implementing the right to erasure.
Facebook also claimed it is in “strong support” of a notification process that gives individuals a clear understanding of how their data is collected and how it will be used.

Let’s not forget: How Cambridge Analytica used your Facebook data to help elect Trump
Snap Inc agrees with Facebook’s argument to align the Privacy Act with the GDPR, recommending the Attorney-General’s Department “review endeavours to pursue a principles-based and proportionate approach in its revisions to the Act, drawing on the strengths of, and the lessons learned from, the [GDPR] in Europe”.
Of concern to Snap is that the Privacy Act does not currently contain a controller/processor distinction. Under the EU’s rules, controllers are responsible for determining the means and purposes of data processing, and processors act on behalf of the instructions of controllers.
“This distinction between controllers and processors increases accountability between parties,” Snap says in its submission [PDF].
“To increase the flexibility, and thus efficiency, of Australia’s privacy legislation we recommend aligning with the definitions of controllers and processors as defined in the EU [GDPR].”
Controller/processor notions are present in privacy laws outside of Europe, such as India, Japan, and Brazil.
Snap said, from the outset, its privacy principles have aligned with those of the GDPR. It has asked the Australian government to follow the GDPR closely, in particular, its principles-based approach.
“The GDPR already covers a number of the areas that this consultation seeks to address, including transparency and proportionality,” Snap wrote.
“Consequently, we would urge the Attorney-General’s Department to, as far as possible, mirror the principles-based approach of the GDPR which provides sufficient flexibility for businesses to decide how they will comply with the standards set by the Regulation as well as sufficient flexibility for data protection authorities to apply the rules in a smart, contextual way.
“We would also urge against any undermining of the delicate balance of interests carefully struck during the GDPR negotiations.”
On consent, Snap said consent alone is not an effective way to manage personal information as it places a lot of responsibility on users, which can result in consent fatigue.
“The legislator should consider legitimate interest as a basis for processing, combined with the requirement for controllers to conduct legitimate interest assessments. Legitimate interests place the burden on controllers, and require them to think critically about the data they process. This creates an accountability framework, and also offers users a more seamless user experience, without jeopardising their privacy,” it wrote.
This makes consent more meaningful, Snap believes.
Facebook, however, said the current definition of consent in the Act is sufficient and provides sufficient flexibility for consumers and businesses.
Agreeing with Google, Snap also believes 13 should be the age at which parental consent is no longer required. While Facebook did not provide comment on the age of consent, in its submission, it pointed to “Messenger Kids”, which is a video and chat app specifically for those under the age of 13, as being an environment where children can “develop digital literacy and safe online behaviours” and be “empowered”.
Facebook has previously warned the looming changes to phone giant Apple’s operating system could negatively impact its advertising revenue, with Mark Zuckerberg arguing that Apple’s changes are aimed at benefiting iMessage and harm small businesses. It will also harm one of Facebook’s recipe to success — tracking-based ad targeting.
Snap also took concern with the iOS 14 changes, saying they present a risk of interruption to demand after they’re implemented, but the company said it’s prepared for the changes.
During the company’s Q4 earnings call, CEO Evan Spiegel said the policy changes Apple is making will impact Snap’s ability to “effectively measure and optimise advertising outside of Snapchat”.
“The reality is we admire Apple, and we believe that they are trying to do the right thing for their customers,” CNBC quotes Snap chief business officer Jeremi Gorman as saying. “Their focus on protecting privacy is aligned with our values and the way we’ve built our business from the very beginning. Overall, we feel really well prepared for these changes, but changes to this ecosystem are usually disruptive and the outcome is uncertain.”
MORE FROM THE PRIVACY ACT REVIEW More

[embedded content]
An unidentified hacker has accessed the computer systems for the water treatment facility in the city of Oldsmar, Florida, and has modified chemical levels to dangerous parameters.
News of the attack was disclosed today in a press conference by city officials.

ZDNet Recommends

The intrusion took place on Friday, February 5, when the hacker accessed a computer system that was set up to allow for the remote control of water treatment operations.
The hacker first accessed this system at 8 am, in the morning, and then again for a second and more prolonged intrusion at 1:30 pm, in the afternoon.
This second intrusion lasted for about five minutes and was detected right away by an operator who was monitoring the system and saw the hacker move the mouse cursor on the screen and access software responsible for water treatment.
Hacker modified lye levels
“Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners. It’s also used to control water acidity and remove metals from drinking water in the water treatment plant,” said Oldsmar Sheriff Bob Gualtieri.
“The hacker changed the sodium hydroxide from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase.”

Oldsmar city staff said that no tainted water was delivered to local residents as the attack was caught in time before any lye levels could be deployed.
According to Sheriff Gualtieri, the hacker disconnected as soon as they modified the lye levels, and a human operator set the chemical level back to normal right away.
Officials didn’t attribute the attack to any specific hacker group or entity. The timing of the attack is also of note as the city of Oldsmar is located near the Tampa urban center, which hosted the Super Bowl LV game on Sunday.
Not the first time
This is the second incident of its kind where a hacker has accessed a water treatment facility and modified chemical levels.
A similar incident was reported back in 2015-2016 at an unnamed water treatment facility, but investigators said the intruders didn’t seem to know what they were doing, making random changes, and investigators classified the intrusion as an accident rather than an intentional attack.
Another set of attacks took place earlier this year, but without as dire consequences. In the spring and summer of 2020, Israeli officials reported attacks against local water treatment facilities, water pumps, and agricultural irrigation systems.
Tel Aviv officials, which blamed the attacks on the Iranian government, said hackers tried to access the management panels of several types of smart water management systems and asked local organizations to change their passwords.
None of the attacks were successful, officials and local media reported at the time. More

Although fewer of us are working out of airports, hotels, and coffee shops in these pandemic days, many of us are working outside of our employer’s facilities. This, along with the ever-increasing levels of cybercrime and hacking, is inspiring many people to install VPNs.
In a home environment, VPNs not only secure your connection from home to whatever online service you’re connecting to, but they also secure your connection from others on your Wi-Fi network. If you have confidential information you don’t want to share with roommates, or you’d prefer your teenager doesn’t have access to corporate, health, lifestyle, or financial information, a VPN will keep the connection from your computer, phone, or tablet secure from the prying eyes of the young digital natives in your midst.
In this article, we’ll present a few general installation and configuration guidelines. Then we’ll walk you, step-by-step, through the installation of four popular VPNs, one for each platform. We’ll be demonstrating how to install and setup NordVPN on iOS, IPVanish on MacOS, ExpressVPN on Windows 10, and Surfshark on Android.

Some quick tips
First and foremost, you must understand that your experience with a VPN will differ from others, especially those of us doing reviews. Every Internet connection performs differently, so even though we explored what VPNs are fastest, keep in mind that where you’re connecting from and what you’re connecting to will differ from the experience of other users. When choosing a VPN, make sure to take advantage of the trial time or the money-back guarantee. Definitely test before committing.
Second, you’ll need to decide if you want your VPN to always be on or only turn on when you tell it. If you want your VPN to be active from the moment the device boots up, make that selection in the preferences for your VPN application. If you want your VPN to be active only on occasion, turn off the enable-on-startup option for the VPN you’ve chosen.
Most modern VPN services have what’s called a Kill Switch. Some apps turn this on by default. Others have an option buried in preferences to enable it. What a kill switch does is disable your network connection if the VPN software fails. I generally recommend turning this on, because if you’re using a VPN, you want it to prevent others from seeing your data. You don’t want to take the chance that if it fails, your data will suddenly be unprotected.

NordVPN
As with all iOS apps, when it’s time to install a VPN on your iPhone or iPad, you’ll need to go to the App Store and find the application. For our iOS install example, we’ve chosen NordVPN. NordVPN scored our top slot in average aggregate scores among a field of nearly a dozen VPNs. It was one of the fastest VPNs, and its score was consistent across most testers on the Internet.
View Now at NordVPN
Also:

Now let’s look at the steps you’ll take installing a VPN on iOS:
When doing an iOS install, first launch the App Store and search for the VPN you want.
When you find the VPN you want, hit Get.
Next, authorize the download using Touch ID, Face ID, or your Apple password.
Once the app downloads, go ahead and launch it.
Most iOS VPN apps are similar from here. You may be asked permission to allow the app to send you alerts. I’d recommend approving this, because if your VPN has something important to tell you (usually about your connection), you probably want to know.
iOS also requires you to approve adding VPN functionality into the operating system. You’ll need to give the VPN approval, and also, probably, turn it on in the Settings panel.
Finally, decide whether you want the VPN to launch automatically when you boot up your phone.
If you want to see this process with NordVPN, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up an iOS VPN.

IPVanish
Unlike iOS, few popular VPNs are available in the MacOS app store. Instead, you’ll need to go to the VPN’s website and download the app, open the archive, and install it manually. For our Mac install example, we’ve chosen IPVanish. While IPVanish didn’t score near the top in terms of overall aggregate performance, we liked its relatively low ping time and quick time to make a connection. We also like the depth of control and options IPVanish offers, along with a very slick performance chart that constantly updates.
View Now at IPVanish
Also: IPVanish review: VPN delivers a wealth of options and browsing controls
Now let’s look at the steps you’ll take installing a VPN on a Mac:
When doing a Mac install, go to the VPN’s website. You may need to purchase or request a trial, and you may need to create an account.
Download the VPN’s installer.
Launch the installer or double-click the archive file. You’ll probably need to give MacOS permission to open it.
Installation may require you to run an installer or copy the application into your Applications folder. Do whichever fits your circumstances.
Most Mac VPN apps are similar from here. You may be asked for various permissions, including permission to run an app downloaded from the Internet and permission to install certain features. If you’re trying to install an app from a known VPN provider, go ahead and approve those requests.
Finally, decide whether you want the VPN to launch automatically when you boot up your Mac.
If you want to see this process with IPVanish, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up a Mac VPN.

ExpressVPN
As with Mac, few popular VPNs are available in the Microsoft Store. Once again, you’ll need to go to the VPN’s website and download the app, open the archive, and install it manually. For our Windows install example, we’ve chosen ExpressVPN. ExpressVPN was near the top in terms of overall aggregate performance, we liked its wide selection of device support. 
View Now at ExpressVPN
CNET: ExpressVPN review: This speedy VPN is worth the price
Now let’s look at the steps you’ll take installing a VPN on Windows:
When doing a Windows install, go to the VPN’s website. You may need to purchase or request a trial, and you may need to create an account.
Download the VPN’s installer. I prefer to download the installer file and then run it, rather than run it directly. I like being able to keep a copy of my installer files.
Launch the installer or double-click the archive file. You’ll probably need to give Windows permission to open it.
Most Windows VPN apps are similar from here. You may be asked by Windows Device Guard for various permissions, including permission to install certain features and send and receive data. If you’re trying to install an app from a known VPN provider, go ahead and approve those requests.
Finally, decide whether you want the VPN to launch automatically when you boot up Windows.
If you want to see this process with ExpressVPN, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up a Windows VPN.

Surfshark
Although you can certainly sideload some Android apps, you’re definitely safest (especially with VPNs) when you install a VPN from the Google Play store. For our Android install example, we’ve chosen Surfshark. Surfshark was a middle-of-the-road performer in our average aggregate scores among a field of nearly a dozen VPNs, but was rated as blazing fast by CNET’s review. This is why we always recommend you test to see how a VPN performs for you.
View Now at Surfshark
CNET: Surfshark VPN review: Competitive pricing and blazing speeds from this upstart service
Now let’s look at the steps you’ll take installing a VPN on Android:
When doing an Android install, first launch the Google Play store and search for the VPN you want.
When you find the VPN you want, tap Install.
Once the app downloads, go ahead and launch it.
Most Android VPN apps are similar from here. Android isn’t as fussy about permissions as iOS, but it does ask its fair share. You’ll need to give the VPN approval as requested during install and first operation.
Finally, decide whether you want the VPN to launch automatically when you boot up your phone.
If you want to see this process with Surfshark, take a look at the gallery below. We show you screenshot-by-screenshot steps for setting up an Android VPN.

And there you go. You’ve seen it’s pretty easy to set up a VPN for all four of the major platforms. Yes, I know I didn’t include Linux, but let’s face it: If you’re already running Linux, you don’t need me to tell you how to install a VPN (or anything else for that matter).
 Are you running a VPN? What service are you using, on what platforms? Let us know in the comments below.
You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.

ZDNet Recommends More