A study of 281 free Android VPN apps revealed significant security flaws, including traffic leaks and unencrypted data transmission. With over 2.4 billion installs, these weaknesses compromise user privacy and could allow malicious actors to redirect traffic.
Researchers tested 281 popular free VPN apps available on the Google Play Store using a newly developed system called MVPNalyzer. The goal was to evaluate the effectiveness of these apps in securing user traffic, which is the primary reason users turn to VPNs.
Findings revealed that many of these apps fail to provide basic security measures, leading to significant privacy risks for users.
The study found that 29 apps were leaking user traffic outside of their encrypted tunnels, exposing DNS requests that reveal the websites users visit. These leakage issues could allow local network operatives, such as on public Wi-Fi, to view users' online activities.
Additionally, 61 apps were identified as transmitting data in plain text, meaning that their traffic could easily be read by anyone monitoring the network. This raises serious questions about the privacy protection these VPNs are supposed to provide.
The most alarming finding involved five specific VPN apps that transmitted their configuration files unencrypted. This vulnerable file directs the app to the correct server, and if intercepted, an attacker could redirect users to a malicious server without their knowledge.
Researchers demonstrated this vulnerability, validating the seriousness of the issue. They reported it to the affected app providers, with two promising to transition to secure HTTPS connections for these files.
With more than 2.4 billion installs of the flagged apps, these vulnerabilities pose a significant risk to a large number of users. The findings emphasize the critical need for a trust reassessment, as users believe they are ensuring privacy while utilizing these services.
The release of the MVPNalyzer framework marks a significant step in the effort to improve security audits for Android VPN apps, potentially leading to better practices and increased accountability among app developers.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
A study of 281 free Android VPN apps revealed significant security flaws, including traffic leaks and unencrypted data transmission. With over 2.4 billion installs, these weaknesses compromise user privacy and could allow malicious actors to redirect traffic.