Hola VPN still riddled with security holes, researchers claim
UPDATE 4.6.2015 10.46GMT: Clarifications by Vectra.
Hola's VPN network has been described as "an ideal platform" for executing targeted cyberattacks by security researchers looking into Hola's questionable business practices.
Last week, the virtual private network and geolocation unblocker service Hola acknowledged that the bandwidth of individuals using the free version of the software was being sold to cover operational costs. Used by approximately 46 million users worldwide, Hola is available in both free and premium versions -- and the free option, which acts as a P2P network, pools inactive PC resources from millions of systems to power Hola's premium Luminati VPN service.
The admission was made following the public complaints of 8chan message board operator Fredrick Brennan, who alleges users of the Hola network have unwittingly been fueling a botnet used to conduct multiple attacks on his website.
Each user of the free service becomes an endpoint for the network, and therein lies the issue -- if security flaws exist in Hola's network, this could then in theory be exploited by attackers who use the botnet for their own ends.
Calling Hola "the most unethical VPN I have ever seen," Brennan says the Luminati botnet consists of over nine million exit nodes.
Following these reports, Hola updated the company's FAQ to clear up the process. Within the FAQ, the Israel-based firm says valuable resources are never taken, and a user's IP is only used as a proxy if the device is fully idle.
However, continual criticism of the business model has led Hola founder Ofer Vilenski to pen an open letter to Hola users. Vilenski writes:
"There have been some terrible accusations against Hola which we feel are unjustified. We innovated quickly, but it looks like Steve Jobs was right. We made some mistakes, and now we're going to fix them, fast."
Hola is a P2P network and free users are required to share their resources to use the IP disguising service -- but this information is now being included more prominently on the firm's website and during installation procedures. Vilenski also emphasized that the network should not be considered a botnet-for-hire; instead, Luminati is meant to be used for legitimate commercial purposes.
However, the executive admitted that a "spammer" was able to use the network last week by posing as a company and so new monitoring solutions will be put in place to minimize the risk of future abuse.
In addition, Hola plans to hire a Chief Security Officer (CSO) in the coming weeks -- something that arguably should have been done some time ago, considering how many users Hola caters for.
Hola also admitted that two vulnerabilities were discovered in the past week which may have led to the remote exploit of some devices which use Hola. According to the advisory, the flaws could not only lead to arbitrary code execution, but privilege escalation -- and design flaws could allow Hola users to be tracked, which goes against what the service ultimately stands for.
"The hackers who identified these issues did their job, and we did our job by fixing them," Vilenski says. "In fact, we fixed both vulnerabilities within a few hours of them being published and pushed an update to all our community."
The vulnerabilities were found by researchers at Adios Hola. While the VPN service claims the issues have been fixed, the researchers disagree. In an update, the team said:
"The vulnerabilities are *still* there, they just broke our vulnerability checker and exploit demonstration. Not only that; there weren't two vulnerabilities, there were six.
Hola also claims that "[vulnerabilities happen] to everyone. As we have pointed out from the start, the security issues with Hola are of such a magnitude that it cannot be attributed to 'oversight'; rather, it's straight-out negligence. They are not comparable to the others mentioned -- they are much worse."
The PR train crash does not end there. A new analysis released by cybersecurity firm Vectra is likely to place even more strain on Hola, as not only do the team insist the network acts like a botnet, but also imply that some of Luminati's design features suggest dark purposes, and "contains a variety of features that make it an ideal platform for executing targeted cyber attacks."
The team says the 8chan forum is not likely the first time Hola has been used for malicious activity. During Vectra's investigation, the firm discovered five different malware samples which contain the Hola protocol.
"Unsurprisingly, this means that bad guys had realized the potential of Hola before the recent flurry of public reports by the good guys," Vectra says.
In addition, Vectra says the network contains a "variety of capabilities that can enable a targeted, human-driven cyber attack on the network in which a Hola user's machine resides," including Hola software's ability to download additional software without user consent and a built-in console which remains active even when the user is not browsing the web.
This console's existence represents a risk to users as it could allow hackers to communicate with a Hola node even when the service is not active.
According to Vectra, this paves the way for problems including process killing, file downloads which bypass antivirus checks, executing download files and opening sockets to IP addresses and devices, among other security concerns. The team concludes:
"These capabilities enable a competent attacker to accomplish almost anything. This shifts the discussion away from a leaky and unscrupulous anonymity network, and instead forces us to acknowledge the possibility that an attacker could easily use Hola as a platform to launch a targeted attack within any network containing the Hola software."
Hola says the company is currently undergoing both an internal and external security review and audit, and will soon launch a bug bounty program to ferry out additional security problems.
ZDNet has reached out to Hola and will update if we hear back.
UPDATE 10.46GMT: Following communications between Hola and Vectra researchers, the latter has clarified their position in an update, clarifying that Hola was used to enable a botnet and is itself, not a botnet.
Read on: In the world of security
'ZDNET Recommends': What exactly does it mean?
ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.
When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.
ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.
Updated Kaseya ransomware attack FAQ: What we know now
Kaseya, an IT solutions developer for MSPs and enterprise clients, announced that it had become the victim of a cyberattack on July 2, over the American Independence Day weekend.
It appears that attackers have carried out a supply chain ransomware attack by leveraging a vulnerability in Kaseya's VSA software against multiple managed service providers (MSP) -- and their customers.
Also: Kaseya issues patch for on-premise customers, SaaS rollout underway
According to Kaseya CEO Fred Voccola, less than 0.1% of the company's customers were embroiled in the breach -- but as their clientele includes MSPs, this means that smaller businesses have also been caught up in the incident.
Present estimates suggest that 800 to 1500 small to medium-sized companies may have experienced a ransomware compromise through their MSP.
The attack is reminiscent of the SolarWinds security fiasco, in which attackers managed to compromise the vendor's software to push a malicious update to thousands of customers. However, we are yet to find out just how widespread Kaseya's ransomware incident will prove to be.
Here is everything we know so far. ZDNet will update this primer as we learn more.
What is Kaseya?
Kaseya's international headquarters is in Dublin, Ireland, and the company has a US headquarters in Miami, Florida. The vendor maintains a presence in 10 countries.
Kaseya provides IT solutions including VSA, a unified remote-monitoring and management tool for handling networks and endpoints. In addition, the company provides compliance systems, service desks, and a professional services automation platform.
The firm's software is designed with enterprises and managed service providers (MSPs) in mind, and Kaseya says that over 40,000 organizations worldwide use at least one Kaseya software solution. As a provider of technology to MSPs, which serve other companies, Kaseya is central to a wider software supply chain.
What happened?
On July 2 at 2:00 PM EDT, as previously reported by ZDNet, Kaseya CEO Fred Voccola announced "a potential attack against the VSA that has been limited to a small number of on-premise customers."
At the same time, out of an abundance of caution, Voccola urged clients to immediately shut down their VSA servers.
"It's critical that you do this immediately because one of the first things the attacker does is shut off administrative access to the VSA," the executive said.
Customers were notified of the breach via email, phone, and online notices.
As Kaseya's Incident Response team investigated, the vendor also decided to proactively shut down its SaaS servers and pull its data centers offline.
By July 4, the company had revised its thoughts on the severity of the incident, calling itself the "victim of a sophisticated cyberattack."
Cyber forensics experts from FireEye's Mandiant team, alongside other security companies, have been pulled in to assist.
"Our security, support, R&D, communications, and customer teams continue to work around the clock in all geographies to resolve the issue and restore our customers to service," Kaseya said, adding that more time is needed before its data centers are brought back online.
Once the SaaS servers are operational, Kaseya will publish a schedule for distributing a security patch to on-prem clients.
In a July 5 update, Kaseya said that a fix has been developed and would first be deployed to SaaS environments, once testing and validation checks are complete.
"We are developing the new patch for on-premises clients in parallel with the SaaS Data Center restoration," the company said. "We are deploying in SaaS first as we control every aspect of that environment. Once that has begun, we will publish the schedule for distributing the patch for on-premises customers."
The ransomware attack, explained
The FBI described the incident succinctly: a "supply chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple MSPs and their customers."
Huntress (1,2) has tracked 30 MSPs involved in the breach and believes with "high confidence" that the attack was triggered via an authentication bypass vulnerability in the Kaseya VSA web interface.
According to the cybersecurity firm, this allowed the attackers to circumvent authentication controls, gain an authenticated session, upload a malicious payload, and execute commands via SQL injection, achieving code execution in the process.
Kyle Hanslovan, CEO and co-founder of Huntress, told attendees of a webinar discussing the technical aspects of the attack on July 6 that the threat actors responsible were "crazy efficient."
"There is no proof that the threat actors had any idea of how many businesses they targeted through VSA," Hanslovan commented, adding that the incident seemed to be shaped more due to a "race against time."
"Some of the functionality of a VSA Server is the deployment of software and automation of IT tasks," Sophos noted. "As such, it has a high level of trust on customer devices. By infiltrating the VSA Server, any attached client will perform whatever task the VSA Server requests without question. This is likely one of the reasons why Kaseya was targeted."
The vendor has also provided an in-depth technical analysis of the attack.
Security expert Kevin Beaumont said that ransomware was pushed via an automated, fake, and malicious software update using Kaseya VSA dubbed "Kaseya VSA Agent Hot-fix".
"This fake update is then deployed across the estate -- including on MSP client customers' systems -- as it [is] a fake management agent update," Beaumont commented. "This management agent update is actually REvil ransomware. To be clear, this means organizations that are not Kaseya's customers were still encrypted."
With a tip from RiskIQ, Huntress is also investigating an AWS IP address that may have been used as a launch point for the attack.
On July 5, Kaseya released an overview of the attack, which began on July 2 with reports of ransomware deployment on endpoints.
"In light of these reports, the executive team convened and made the decision to take two steps to try to prevent the spread of any malware: we sent notifications to on-premises customers to shut off their VSA servers and we shut down our VSA SaaS infrastructure," the company says.
According to the firm, zero-day vulnerabilities were exploited by the attackers to trigger a bypass authentication and for code execution, allowing them to infect endpoints with ransomware. However, Kaseya emphasizes that there is no evidence of the VSA codebase being "maliciously modified".
Wietse Boonstra, a Dutch Institute for Vulnerability Disclosure (DIVD) researcher, previously identified a number of vulnerabilities, tracked as CVE-2021-30116, which were used in the ransomware attacks. They were reported under a Coordinated Vulnerability Disclosure pact.
"Once Kaseya was aware of our reported vulnerabilities, we have been in constant contact and cooperation with them. When items in our report were unclear, they asked the right questions," DIVD says. "Also, partial patches were shared with us to validate their effectiveness. During the entire process, Kaseya has shown that they were willing to put in the maximum effort and initiative into this case both to get this issue fixed and their customers patched. "
Who has been impacted?
Over the weekend, Kaseya said that SaaS customers were "never at risk" and current estimates suggest that fewer than 40 on-prem clients worldwide have been affected.
However, it should be noted that while a small number of Kaseya clients may have been directly infected, as MSPs, SMB customers further down the chain relying on these services could be impacted in their turn.
According to reports, 800 Coop supermarket chain stores in Sweden had to temporarily close as they were unable to open their cash registers.
Huntress said in a Reddit explainer that an estimated 1,000 companies have had servers and workstations encrypted. The vendor added that it is reasonable to suggest "thousands of small businesses" may have been impacted.
"This is one of the farthest-reaching criminal ransomware attacks that Sophos has ever seen," commented Ross McKerchar, Sophos VP. "At this time, our evidence shows that more than 70 managed service providers were impacted, resulting in more than 350 further impacted organizations. We expect the full scope of victim organizations to be higher than what's being reported by any individual security company."
On July 5, Kaseya revised previous estimates to "fewer than 60" customers, adding that "we understand the total impact thus far has been to fewer than 1,500 downstream businesses."
Now, on July 6, the estimate is between 50 direct customers, and between 800 and 1,500 businesses down the chain.
When it comes to SaaS environments, Kaseya says, "We have not found evidence that any of our SaaS customers were compromised."
In a press release dated July 6, Kaseya has insisted that "while impacting approximately 50 of Kaseya's customers, this attack was never a threat nor had any impact to critical infrastructure."
The number of vulnerable Kaseya servers online, visible, and open to attackers dropped by 96% from roughly 1,500 on July 2 to 60 on July 8, according to Palo Alto Networks.
Kaseya CEO Fred Voccola said that the attack, "for the very small number of people who have been breached, it totally sucks."
"We are two days after this event," Voccola commented. "We have about 150 people that have probably slept a grand total of four hours in the last two days, literally, and that'll continue until everything is as perfect as can be."
Less than 0.1% of the company's customers experienced a breach.
"Unfortunately, this happened, and it happens," the executive added. "Doesn't make it okay. It just means it's the way the world we live in is today."
What is ransomware?
Ransomware is a type of malware that specializes in the encryption of files and drives.
In what has become one of the most severe and serious security problems modern businesses now face, ransomware is used by threat actors worldwide to hijack systems and disrupt operations.
Once a victim's system or network has been encrypted, cyber criminals will place a ransom note on the system, demanding payment in return for a decryption key (which may, or may not, work).
Today's ransomware operators may be part of Ransomware-as-a-Service (RaaS), when they 'subscribe' to access and use a particular type of ransomware. Another emerging trend is double extortion, in which a victim will have their information stolen during a ransomware raid.
If they refuse to pay up, they may then face the prospect of their data being sold or published online.
Common and well-known ransomware families include REvil, Locky, WannaCry, Gandcrab, Cerber, NotPetya, Maze, and Darkside.
Read on: What is ransomware? Everything you need to know about one of the biggest menaces on the web
See also:
Who is responsible?
The cyberattack has been attributed to the REvil/Sodinikibi ransomware group, which has claimed responsibility on its Dark Web leak site, "Happy Blog."
In an update over the weekend, the operators, believed to have ties to Russia, claimed that more than "a million" systems have been infected.
REvil has offered a decryption key, allegedly universal and, therefore, able to unlock all encrypted systems, for the 'bargain' price of $70 million in the bitcoin (BTC) cryptocurrency.
REvil has been previously linked to ransomware attacks against companies, including JBS, Travelex, and Acer.
What are the ransomware payment terms?
The ransomware note claims that files are "encrypted, and currently unavailable." A file extension .csruj has reportedly been used. Operators are demanding payment in return for a decryption key and one 'freebie' file decryption is also on the table to prove the decryption key works.
The operators add (spelling unchanged):
"Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. If you will not cooperate with our service --for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money."
Sophos malware analyst Mark Loman shared a screenshot on Twitter of a ransomware note planted on an infected endpoint demanding $44,999.
John Hammond, senior security researcher at Huntress, told ZDNet that the company has already seen ransom demands of up to $5 million.
Kevin Beaumont says that, unfortunately, he has observed victims "sadly negotiating" with the ransomware's operators.
Fabian Wosar, CTO of Emsisoft, has also explained in a Twitter thread why using a key obtained by a single organization paying up is unlikely to be a viable path for unlocking all victims.
"REvil absolutely has the capability of decrypting only a single victim without these purchased decryption tools being applicable for other victims hit by the same campaign public key," the security expert noted.
CNBC reports that the universal ransom demand has been reduced to $50 million in private conversations. However, as of July 7, the public demand for $70 million on the threat group's leak site remains unchanged.
What are the reactions so far?
At the time of the breach, Kaseya notified law enforcement and cybersecurity agencies, including the Federal Bureau of Investigation (FBI) and US Cybersecurity and Infrastructure Security Agency (CISA).
The FBI and CISA have released a joint statement on the security incident and are urging customers to run a tool provided by Kaseya to determine the risk of exploit, and to both enable and enforce multi-factor authentication (MFA) on enterprise accounts, wherever possible.
Kaseya has been holding meetings with the FBI and CISA "to discuss systems and network hardening requirements prior to service restoration for both SaaS and on-premises customers."
The White House is asking organizations to inform the Internet Crime Complaint Center (IC3) if they suspect they have been compromised.
On Saturday, US President Biden said he has directed federal intelligence agencies to investigate.
"Targeting [an] MSP platform (that is managing many customers at once) was very well thought and planned," Amit Bareket, CEO of Perimeter 81, told ZDNet. "What's unique is that hackers are becoming more strategic and targeting platforms that will filtrate down to many companies with one shot. RMMs [remote monitoring and management] are basically keys to many many companies, which amount to the kingdom for bad actors."
The White House has attempted to strengthen its stance on cybercrime in light of this attack, warning Russian President Vladimir Putin that unless he deals with the problem in his own backyard, "we will take action or reserve the right to take action on our own."
Are there any recovery plans?
As of July 4, Kaseya says the company has now moved on from a root cause analysis of the attack to recovery and patch plans, consisting of:
- Communication of our phased recovery plan with SaaS first followed by on-premises customers.
- Kaseya will be publishing a summary of the attack and what we have done to mitigate it.
- Some lightly-used legacy VSA functionality will be removed as part of this release out of an abundance of caution. A specific list of the functionality and its impact on VSA capabilities will be outlined in the release notes.
- There will be new security measures implemented including enhanced security monitoring of our SaaS servers by FireEye and enablement of enhanced WAF capabilities.
- We have successfully completed an external Vulnerability Scan, checked our SaaS Databases for Indicators of Compromise, and have had external security experts review our code to ensure a successful service restart.
Data centers starting with the EU will be restored, followed by the UK, APAC, and then North American systems.
By late evening on July 5, Kaseya said a patch has been developed and it is the firm's intention to bring back VSA with "staged functionality" to hasten the process. The company explained:
- The first release will prevent access to functionality used by a very small fraction of our user base, including:
- Classic Ticketing
- Classic Remote Control (not LiveConnect).
- User Portal
Kaseya has now published an updated timeline for its restoration efforts, starting with the relaunch of SaaS servers, now set for July 6, 4:00 PM EDT and 7:00 PM EDT. Configuration changes to improve security will follow, including an on-premise patch, expected to land in 24 hours, or less, from the time SaaS servers come back online.
"We are focused on shrinking this time frame to the minimal possible -- but if there are any issues found during the spin-up of SaaS, we want to fix them before bringing our on-premises customers up," the firm says.
Additional security improvements include the creation of 24/7 SOCs for VSA, as well as a complimentary CDN with a web application firewall (WAF) for every VSA.
Update July 7: The timeline has not been met. Kaseya said that "an issue was discovered that has blocked the release" of the VSA SaaS rollout.
"We apologize for the delay and R&D and operations are continuing to work around the clock to resolve this issue and restore service," Kaseya commented.
In a service update, the vendor said it has been unable to resolve the problem.
"The R&D and operations teams worked through the night and will continue to work until we have unblocked the release," Kaseya added.
July 7, 12 pm EDT:
Kaseya hopes to resolve the SaaS systems rollout no later than the evening of Thursday, July 8. A playbook is currently being written up, due to be published today, which will provide guidelines for impacted businesses to deploy the upcoming on-prem VSA patch.
Current recovery status
As of July 8, Kaseya has published two run books, "VSA SaaS Startup Guide," and "On Premises VSA Startup Readiness Guide," to assist clients in preparing for a return to service and patch deployment.
Recovery, however, is taking longer than initially expected.
"We are in the process of resetting the timelines for VSA SaaS and VSA On-Premises deployment," the company says. "We apologize for the delay and changes to the plans as we work through this fluid situation."
In a second video message recorded by the firm's CEO, Voccola said:
"The fact we had to take down VSA is very disappointing to me, it's very disappointing to me personally. I feel like I've let this community down. I let my company down, our company let you down. [..] This is not BS, this is the reality."
The new release time for VSA is Sunday, in the afternoon, Eastern Time, in order to also harden the software and bolster its security ahead of deployment.
July 12: Kaseya has now released a patch and is working with on-prem customers to deploy the security fix. Now, 100% of all SaaS customers are live, according to the company.
"Our support teams continue to work with VSA on-premises customers who have requested assistance with the patch," Kaseya added.
What can customers do?
Kaseya has released a tool, including Indicators of Compromise (IoC), which can be downloaded via Box. There are two PowerShell scripts for use: one on a VSA server, and the other has been designed for endpoint scanning.
The self-assessment scripts should be used in offline mode. They were updated on July 5 to also scan for data encryption and REvil's ransom note.
However, the scripts are only for potential exploit risk detection and are not security fixes. Kaseya will release patches as quickly as it can, but in the meantime, customers simply have to wait until Sunday.
Kaseya intends to bring customers back online on July 11, at 4 PM EDT.
"All on-premises VSA Servers should continue to remain offline until further instructions from Kaseya about when it is safe to restore operations," the firm said. "A patch will be required to be installed prior to restarting the VSA."
Cado Security has provided a GitHub repository for responders, including malware samples, IoCs, and Yara Rules.
Truesec CSIRT has also released a script on GitHub to identify and mitigate damage on infected systems.
Kaseya has also warned that scammers are trying to take advantage of the situation.
"Spammers are using the news about the Kaseya Incident to send out fake email notifications that appear to be Kaseya updates. These are phishing emails that may contain malicious links and/or attachments.
Do not click on any links or download any attachments claiming to be a Kaseya advisory."
Are REvil still active?
After Biden made his stance clear to Putin on ransomware gangs, the REvil ransomware group's leak site was seized and taken down by law enforcement.
The takedown included REvil's payment site, public domain, helpdesk chat platform, and the negotiation portal.
While the intention was to secure some form of control over the group, it should be noted that ransomware operators often close down sites, rebrand, and regroup.
A side effect of the takedown is that the removal of negotiation and the possibility of purchasing a decryption key have left victims with unrecoverable systems. One victim who paid up for a decryption key -- which ended up not working -- is now out of pocket and unable to secure assistance from the cybercriminals.
A decryption key?
On July 22, Kaseya said that the company has managed to secure a decryption key. Obtained by a "third-party," the decryption key has been tested successfully in victim environments -- and the suggestion is that the decryption key may be universal.
The company is working with Emsisoft to reach customers still suffering due to locked systems and in need of a decryption key.
"We remain committed to ensuring the highest levels of safety for our customers and will continue to update here as more details become available," Kaseya said. "Customers who have been impacted by the ransomware will be contacted by Kaseya representatives."
Kaseya has denied paying for the decryption key.
Kaseya attack
'ZDNET Recommends': What exactly does it mean?
ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.
When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.
ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.
I gave away my Kindle and iPad within hours of testing this Android tablet
ZDNET's key takeaways
- The TCL Tab 10 Nxtpaper 5G is a full-color, color paper, and ink paper tablet available at Verizon for $239.
- It's a great entertainment tablet for daily use that also functions very well as an e-reader.
- Although the screen is versatile, don't expect the graphics to compare to those on an iPad or other high-end tablets.
Reading is my favorite hobby and something I've come to rely on to wind down before bed. I've had a few Kindles over the past 13 years, and the Amazon e-reader has become my go-to. I tried out TCL's Nxtpaper technology last year as an alternative and haven't looked back.
Also: The best reading tablets in 2025: From Kindle To Apple
The TCL Tab 10 Nxtpaper 5G has been a mainstay in my household for the past several months, but it felt like an upgrade almost immediately. Within hours of setting it up, I gave my daughter my old Kindle, and my husband got my old iPad.
The TCL Tab 10 Nxtpaper 5G's display smoothly transitions from regular mode to color paper or ink paper, whether you're reading, scrolling on social media, watching videos, or playing a game. TCL's Nxtpaper technology isn't the same as E Ink, which uses electrophoretic technology to create a monochromatic image.
Also: The best Android tablets of 2025: Expert tested and reviewed
Instead, Nxtpaper is a paper-like display that helps reduce eye strain and improves readability over traditional screens. The display also reduces blue light, doesn't have a conventional backlight, and eliminates flickering, making it easy on the eyes while displaying the different types of content you'd expect from a flagship tablet or smartphone.
The lack of a backlight and the display's frosted finish reduce glare and reflections, contributing to better energy efficiency and longer battery life. Using several anti-reflective and anti-glare layers, TCL's Nxtpaper enhances readability in different conditions, so you can enjoy that bestseller on a bright day at the beach or by the pool. A front light panel evenly illuminates the screen and helps maintain a comfortable viewing experience.
Also: This $200 Android is the only smartphone at CES that you should care about
E Ink, in turn, doesn't traditionally transition from monochromatic to full color and has a slower refresh rate. Though there are color E Ink displays, they're not as vibrant or suitable for multimedia content.
The TCL Tab 10 Nxpaper is an entertainment tablet that lets you take your essentials anywhere. It's not meant to replace a brand-new $1,000 iPad, but it can replace an e-reader and an older iPad model, which was my case.
I'm not a tablet power user. I don't need a tablet with strong processing power to replace my MacBook Pro or iMac for video editing or graphic design; I mainly use tablets for entertainment. This includes streaming video on YouTube or a subscription service, reading the news, making notes and lists, catching up on baseball, checking the weather, and playing some games. For all of those use cases, this tablet works well.
Also: The best cheap tablets of 2025: Expert tested and reviewed
I sometimes work on my tablet, but as a writer, I only need a keyboard and a reliable note-taking or word-processing app, which are easy to use on this TCL tablet.
When I first tested this device, I wasn't sure what to expect. I had read about TCL's Nxtpaper but hadn't had a chance to test it until this tablet. When I first got my hands on the TCL Tab 10 Nxtpaper 5G tablet, I was surprised with the display's versatility and how easily you could switch from regular mode to color paper to ink paper, the latter being the most similar to what you might expect from an e-reader.
The very first app I downloaded was Kindle. I was excited to see how this tablet would feel as an e-reader, and I wasn't disappointed.
Also: One of the best tablets for watching movies is not from a brand you'd expect
A Kindle e-reader is a single-purpose device, so upgrading to a tablet with a similar display and the benefits of a faster refresh rate and processor was a pleasure. After using the same Kindle for six years, I was blown away by the simple fact that I could breeze through the Kindle app as I would on any other tablet, while the TCL Nxtpaper display looks as good as any e-reader.
The TCL Tab 10 Nxtpaper 5G has its front camera located on the landscape edge.
After reading for about an hour, I made up my mind. I reset the old 10th-generation Kindle, set it up with Amazon Kids for my seven-year-old, and never looked back. Even better, because now my kid is reading more than ever. During the first three days of using the Kindle, she read for four and a half hours. She's been reading for a few years but now dedicates at least 40 minutes of reading each night before bed on her own, whereas before, she'd read maybe 20 minutes a day during the school week.
Also: One of the best Samsung tablets I've tested is not a flagship (and it's on sale)
The TCL Tab 10 Nxtpaper 5G is also perfectly capable of performing the tasks my regular iPad did at home and on the go. Part of being a parent means sitting on the sidelines for hours a week while the kids attend extracurricular activities that cost an arm and a leg.
This tablet has become my new iPad and Kindle while I'm killing time. Plus, if I have a deadline, I can continue my work in Docs; if I'm bored, I can stream on Netflix or scroll through TikTok; and if I'm looking to relax, I can read the latest novel I've downloaded from Kindle Unlimited.
The convenience of two devices in one made it easy to give my husband my old iPad on the same day I set up the TCL Tab 10 Nxtpaper 5G. While the Android experience differs from an iPad, I've encountered minimal bugs and inconveniences. I can still work and play on the TCL Tab 10 Nxtpaper 5G, use a split screen, and stream videos flawlessly.
ZDNET's buying advice
The TCL Tab 10 Nxtpaper 5G is perfect for everyday use. This $239 tablet isn't looking to win any benchmark competitions with high-end devices, but it's an outstanding tablet for the price, especially if you like using an e-reader. But if you're looking to trade in your old tablet and upgrade, you can save up to $180 at Verizon with a trade-in.
Also: The best Samsung tablets of 2024: Expert tested and reviewed
The TCL Tab 10 Nxtpaper 5G tablet is available at Verizon for $239 prepaid or $6.66 monthly for 36 months. TCL sells a T-Pen Stylus for $40 (I plan to pick one up). Verizon plans start at $30 monthly, which isn't cheap. The data plan option is best suited for those who often use the tablet on the go, outside the comforts of Wi-Fi.
I'm keeping the TCL Tab 10 Nxtpaper, data plan or not, because I use it mainly around the house. If I use a tablet or laptop somewhere without Wi-Fi, I'm okay with using my iPhone as a hotspot.
