Researchers from the University of Michigan have developed a toolkit called MVPNalyzer to detect information leaks and analyze VPN performance. They tested 281 VPN applications for the Android platform. The study focused on the most popular VPN applications available in the Google Play catalog. The VPN apps identified with various security and privacy issues account for a total of 2.4 billion installations. Key findings:
- Data transmission without encryption was detected in 61 applications (22%), occurring outside the established tunnel. Most apps in this category are popular, averaging 11 million installations. In 18 applications, there was direct access to the service ip-api.com to determine location based on IP address the client.
In 5 instances, configuration files containing parameters for connecting to the VPN server were transmitted to the client without encryption. Researchers conducted an experiment confirming the potential for a MITM attack, allowing traffic to be redirected to their server, having the ability to intercept the victim's communication channel, for instance, connecting to a public wireless network controlled by the attacker. Problematic applications (the complete list of all applications where issues were identified can be found on page 17 of the PDF report):
- BambooVPN: Turbo Fast VPN (free.vpn.unblock.proxy.bamboovpn);
- VPN Pro (com.nebulatech.voocvpnpro);
- Free VPN (com.appoxide.freevpn);
- Hexa VPN (com.secure.vpn.proxy);
- 101 VPN (com.shwe.vpn101).
The researchers notified the developers of these applications about the issues and, after some time, conducted a follow-up check on the latest versions. The results showed that the vulnerabilities were only fixed in two applications — VPN Pro and Hexa VPN.
- Traffic leakage outside the established tunnel occurs in 29 applications (10%). In 24 applications, which account for 360 million installations, information about visited sites leaked due to direct DNS queries (20 sent DNS queries through local resolvers, while 6 used public DNS services like Google, Cloudflare, AliDNS, and DNSPod). In 6 applications, with a total of 54 million installations, traffic related to user activity in web browsers was sent outside the tunnel. In 4 applications, data was transmitted through an unencrypted tunnel.
- In 169 applications (60%), traffic obfuscation was not applied, using standard network ports and protocols that are tracked in the general flow. This behavior diverges from user expectations — according to a survey conducted last year, 82% of VPN users believe that VPNs provide them with anonymity.
- In 76 applications (27%), unique device identifiers AAID (Android Advertising ID) were transmitted, allowing tracking of devices and users. In 246 applications (87%), access to well-known advertising networks and user tracking services was recorded (a total of 3714 different URLs were accessed). One application sent exact GPS coordinates of the device.
- In 107 applications (38%), settings were applied that do not ensure an optimal level of security. In 20 applications, totaling 40 million installations, insecure encryption methods were used. In 96 applications, with 728 million installations, unreliable authentication mechanisms were employed.
In 3 applications, the OpenVPN setting data-ciphers was set to 'none', allowing the establishment of communication channels without encryption. In 8 applications, the 'cipher' parameter was set to 'none', disabling encryption when using OpenVPN 2.4 and earlier versions. In 12 applications, directives declared deprecated were used. In 61 applications, the OpenVPN configuration did not include directives to block known attack methods.
Source: opennet.ru
