Thursday, 26 January 2017

Most of Android VPNs is not secure , security and privacy issue:Researchers

A team of experts from the University of California, Berkeley, the Data 61 research unit at Australia’s Commonwealth Scientific and Industrial Organisation (CSIRO) and the University of New South Wales have analyzed 283 Google Play apps that request the BIND_VPN_SERVICE permission, which provides native support for VPN clients.

Experts discovered that more than one-third of these Android VPN apps, including ones that are highly popular, appear to include some malicious code when tested with Google’s VirusTotal service. Worryingly, only a small number of users have raised security or privacy concerns in the comments posted to Google Play when reviewing these applications.


Another problem identified during the study is that 18% of the applications do not provide any information on the entity hosting the VPN server, and 16% of them forward traffic through the devices of other users, which can pose serious trust, privacy and security issues. Furthermore, a small percentage of the apps implemented local proxies designed to inspect user traffic, mainly for filtering and security purposes.

Researchers have analyzed hundreds of virtual private network (VPN) applications for Android and determined that many of them introduce serious privacy and security risks.

VPN applications are supposed to provide anonymity and security, but researchers found that 18% of the ones from Google Play implement tunneling protocols without encryption, and many of them don’t tunnel IPv6 and DNS traffic.

A small number of Android VPN apps have been found to intercept TLS traffic and even inject JavaScript code for advertising and tracking purposes.

Researchers have contacted the developers of problematic apps and while some of them confirmed the findings and provided arguments in support of their methods, others did not respond.