In other places during the last year, according to the Kela analysis, users of the cybercrime forum recommended Big Mama or shared advice about the configurations that people should use. In April this year, security company Cisco Talos he said had seen traffic from the Big Mama Proxy, alongside other proxies, being used by attackers looking for brute force in a variety of company systems.

Mixed messages

Big Mama has few details about its ownership or management on its website. The company's terms of service say that a company called BigMama SRL is registered in Romania, although an earlier version of its website from 2022and at least one live page nowlists a legal address for BigMama LLC in Wyoming. The US-based business was dissolved in April and is now listed as inactive, according to the Wyoming Secretary of State's website.

A person using the name Alex A responded to an email from WIRED about how Big Mama operates. In the email, they say that the information about the free user connections that are sold to third parties through the Big Mama Network is "duplicated on the app market and in the application itself several times" , and people must accept the terms of the conditions to use. the VPN. They say that Big Mama VPN is officially available only from the Google Play Store.

"We do not advertise and have never advertised our services on the forums you mentioned," the email says. They said they were not aware of the April findings by Talos about its network being used as part of a cyber attack. "We block spam, DDOS, SSH and even local network etc. We record user activity to cooperate with law enforcement agencies," the email says.

The person Alex A asked WIRED to send more details about the ads on the cybercrime forums, details about the results of Talos, and information about teenagers using Big Mama on Oculus devices, saying that they will be "happy" to answer more questions. However, they did not respond to more emails with additional details about the search results and questions about their security measures, if they believe that someone was impersonating Big Mama to post on cybercrime forums , the identity of Alex A, or who runs the company.

During its analysis, Trend Micro's Hilt says the company also found a security vulnerability in the Big Mama VPN, which could have allowed a proxy user to access someone's local network if exploited. The company says it reported the defect to Big Mama, who fixed it within a week, Alex A confirmed.

Ultimately, Hilt says, there are potential risks whenever someone downloads and uses a free VPN. "All free VPNs come with a trade-off for privacy or security concerns," he says. This applies to people side-loading them onto their VR headsets. "If you download applications from the Internet that are not from official stores, there is always the inherent risk that it is not what you think it is. And this is also true with Oculus devices."