VPN PROMISES BROKEN... ExpressVPN’s Debug Leak

Key Takeaways

A VPN is supposed to encrypt your data and hide your IP addresses, right? Well, in this example, we've got an ExpressVPN bug that leaked users IPs in remote desktop sessions. They've now fixed this flaw in their Windows client that caused remote desktop protocol or RDP protocol traffic to bypass the VPN tunnel, exposing the users's real IP addresses. So, as mentioned, one of the key premises of a VPN is masking a user's IP address, allowing users to stay anonymous online. Have a look at the conversations that I've had with OTW or Occupy the Web about VPNs keeping you anonymous online. Very much doubt that a VPN is going to keep you anonymous online, but may help with that a little bit and in some cases bypass censorship. Failing to do so is a severe technical failure for a VPN product, I would say. So on April 25th, 2025, a security researcher known as Adam X reported a vulnerability through the ExpressVPN bug bounty program that exposed RDP and other TCP traffic over port 3389. The ExpressVPN team found that the issue was caused by remnants of debug code used for internal testing being mistakenly included in production builds specifically from this release which was released about 4 months ago to this version. Okay. Okay, so if a user established a connection using RDP, the traffic would bypass the VPN, this didn't affect encryption, but RDP traffic wasn't routed through ExpressVPN as expected. That means that an ISP or someone else would see your real IP address. Okay, so in somewhat good news, this only affected RDP and they say that not many people use RDP, but it is a worrying development that a product that's supposed to encrypt all your traffic isn't doing that. So the user didn't use a split tunnel or something where they said that RDP mustn't be encrypted. It was supposed to be encrypted and wasn't encrypted. Last year they also faced a DNS request leaks issue when split tunneling was enabled where an ExpressVPN bug has been leaking DNS requests for years. Don't think that a VPN is always going to hide your IP address. As we see here, there could be a bug in the software. You may misconfigure something. VPNs do have their uses. As an example, if I'm traveling to the US and I need to connect to certain websites in the UK, they will block connections from the US. But if I connect to my VPN and connect to a UK server, I can access those websites. I tend to avoid public Wi-Fi, but if I have to use it, I'll use a VPN. Just gives an added level of security, but nothing is bulletproof. So many bugs, so many issues in today's world with software. So, don't believe all the hype about VPN.