Meta
Screenshot do jogo Gorilla Tag
The application was created to help online players cheat, but it could have much more serious implications for cybersecurity.
The players came up with a trick.
Gorilla Tag is a Meta’s virtual reality game (company that owns Instagram, Facebook and Whatsapp) whose protagonist is a monkey that overcomes obstacles.
According to , one of the “tricks” that allow you to cheat in the game is the use of a VPN. This introduces a delay which makes it easier to approach and mark other players.
It seems like just a harmless cheat, but the scheme is becoming a concern for cybersecurity experts.
The free VPN app that the video tutorials point to is called Big Mama VPN and also sells access to users’ home Internet connections — with buyers essentially using the VR headset’s IP address to hide their own online activity.
This traffic redirection technique, which is better known as proxy residencial and which happens most often via phones, has become increasingly popular among criminals who use proxy networks to carry out cyber attacks and use botnets (network of computers infected by malware which is under the control of a single attacker).
Proxy services associated with Big Mama VPN have been talked about a lot on cybercrime forums and publicly associated with at least one cyber attack.
“If you downloaded the application, there is a high chance that your device will be on sale in the market for Big Mama“, it says Stephen Hiltthreat investigator at Trend Micro.
Hilt says that while Big Mama VPN may be being used because is free, does not require users to create an account and apparently has no data limits, security researchers have long warned that Using free VPNs can expose people to risks of privacy and security.
In April of this year, security firm Cisco Talos saw Big Mama proxy traffic, along with other proxies, being used by criminals who attempted to force their way into a variety of business systems.
“Alex A”, the fictitious name of a person who claims to represent the mysterious company, about which little is known, responded to an email from Wired about how Big Mama works.
In the email, write that the information about the free user connections, which are being sold to third parties through the Big Mama network, they are “duplicated on the app market and in the app itself several times”, and people have to accept the terms of conditions to use the VPN. Big Mama VPN is officially only available on the Google Play Store.
“We do not and have never advertised our services on the forums you mentioned,” the email says. It is also written that there was no knowledge of Talos’ findings that its network had been used as part of a cyberattack. “We block spam, DDOS, SSH, as well as the local network, etc. We record user activity to cooperate with authorities”, concludes “Alex A”.
According to researcher Stephen Hilt, There are risks whenever someone downloads and uses a free VPN. “All free VPNs come with a trade-off of privacy or security concerns,” says the expert.
The same goes for people downloading them onto VR headsets (the ones from are called Oculus). “If we are downloading applications from the Internet that are not from official stores, there is always the inherent risk of not being what we think they are. And this even happens with Oculus devices.”
