Major vulnerabilities found in top free VPN apps on Google Play store​​​​​​

[xkryptonx]

Major vulnerabilities found in top free VPN apps on Google Play store

SuperVPN Free VPN Client is one of the most popular free VPN apps you can find on the Google Play store, having gained more than 100 million installs already.

But besides being a very popular app, there’s something else you need to know about this free VPN: SuperVPN Free VPN Client is also very dangerous. You see, our analysis shows that this app has critical vulnerabilities that opens it up to dangerous attacks known as man-in-the-middle (MITM) hacks. These vulnerabilities will allow hackers to easily intercept all the communications between the user and the VPN provider, letting the hackers see everything the user is doing.

This is actually quite the opposite of what a VPN is supposed to do. A VPN is supposed to keep your online activities private and secure from all snooping eyes. In fact, a VPN is supposed to be so safe that, even if a hacker could intercept these communications, it would take them longer than the age of the universe to even begin to decrypt the data. But that’s not what SuperVPN has done here.

What this VPN app has done is to leave its users, people seeking extra privacy and security, to actually have less privacy and security than if they’d used no VPN at all.

The implications here are pretty dire. Based on our research, more than 105 million people could right now be having their credit card details stolen, their private photos and videos leaked or sold online, every single minute of their private conversations recorded and sent to a server in a secret location. They could be browsing a fake, malicious website set up by the hacker and aided by these dangerous VPN apps.

But what’s even worse is that this app isn’t alone: of the top VPN apps we analyzed, 10 free VPN apps have similar critical vulnerabilities. If you’ve installed any of these dangerous VPN apps, you should delete them immediately:

Vulnerable VPN apps on Google Play Store

About this research

In order to undertake our analysis, we first developed a proof of concept for creating a man-in-the-middle (MITM) attack. We then looked at the top apps in Google Play that were returned when searching for the keyword “vpn” in January 2019. We first attempted our MITM attack on two top-10 VPNs – SuperVPN and Best Ultimate VPN – and then filtered and tested the remaining apps.

We disclosed these vulnerabilities to all 10 affected VPN apps in October 2019 and provided them with enough time to fix these issues. Unfortunately, only one of them, Best Ultimate VPN, answered and ultimately patched their app based on the information we provided within this 90-day period. The others did not respond to our queries.

We’ve also reported these vulnerabilities to Google, but so far haven’t heard anything back from them yet.

Key takeaways

• 10 of the top free VPN apps in the Google Play store have significant vulnerabilities, affecting nearly 120 million users
• These vulnerabilities allow hackers to easily intercept user communications, including seeing the visited websites and stealing usernames and passwords, photos, videos, and messages
• 2 apps use hard-coded cryptographic keys, and 10 apps are missing encryption of sensitive data. 2 of these apps suffer from both vulnerabilities.
• One app was already identified as malware, but never removed from the Play store, gaining 100 million installs in the meantime. In earlier research, we identified this app for potentially manipulating Google Play in order to rank highly and get more installs
• 4 of the affected apps are located in Hong Kong, Taiwan or mainland China
• Some apps have their encryption keys hard-coded within the app. This means that, even if the data is encrypted, hackers can easily decrypt this data with the included keys
• Because of the vulnerabilities, hackers can easily force users to connect to their own malicious VPN servers

Let’s take an in-depth look at one app to show what kind of vulnerabilities we found.

SuperVPN putting 100 million users at risk

SuperVPN is a highly popular Android VPN that was in position 5 for the “vpn” keyword at the time of our analysis. According to Google Play, the app has been downloaded more than 100 million times (in January 2019 it only had 50 million installs):

SuperVPN app installs

Just to show you how big of a number that is for any VPN, this is the same number of installs for much more popular apps like Tinder and AliExpress:

Tinder app installs AliExpress app installs

What we did

In our tests, we noticed that SuperVPN connects with multiple hosts, with some communications being sent via unsecured HTTP. This communication contained encrypted data. But after more digging, we found that this communication actually contained the key needed to decrypt the information.

What we found

After decrypting the data, we found sensitive information about SuperVPN’s server, its certificates, and the credentials that the VPN server needs for authentication. Once we had this information, we replaced the real SuperVPN server data with our own fake server data.

Who is behind SuperVPN?

SuperVPN and its developer SuperSoftTech have been in our sights before. Our previous research analyzed the few companies secretly behind many VPN products. From that, we know that SuperSoftTech claims to be based in Singapore, but it actually belongs to the independent app publisher Jinrong Zheng, a Chinese national likely based in Beijing.

We also discovered that SuperVPN had been called out before in a 2016 Australian research article as being the third-most malware-rigged VPN app.

At that time, in 2016, SuperVPN had only 10,000 installs. Now, three years later, it already has more than 100 million installs. Surprisingly, even though multiple articles called out SuperVPN for containing malware, it still hasn’t been removed from the Play store.

This is only one example of vulnerabilities we found in all 10 apps listed in this article.

A reputation for manipulation

SuperVPN was discussed before in our earlier research on the potential manipulation tactics the top VPNs were using to seemingly rank higher in Google Play results.

In that research, we discovered that the top 10 results for the “vpn” keyword in Google Play were all free VPNs. They were ranking more highly than market leader VPNs, such as NordVPN and ExpressVPN. Our research discovered that these better-ranked apps seemed to be using three easy manipulation techniques to get such high rankings.

That means that SuperVPN by SuperSoftTech seems to not only be using manipulation techniques to rank highly in Google Play, but is also dangerously vulnerable.

We attempted to contact Mr. Zheng on multiple occasions, but we have not heard back from him.

How MITM hackers penetrate VPN apps

In order to really understand how critical and dangerous these vulnerabilities are, you have to understand a little of how users normally connect to VPNs.

The exact process for VPNs can seem a bit complicated, but the connection is pretty simple.

Now, with a hacked VPN connection, there’s a MITM hacker who positioned himself right in the middle of your app and the VPN’s backend server:

And this is the dangerous part: by changing the details, he can now force you to connect to his malicious server instead of the real VPN server. While everything will appear to work normally, and you think that you’re being extra safe and secure, you’re actually being seriously exposed.

If you’re browsing the internet through his VPN server, he will be able to see all your communications: your private text and voice messages, your passwords, your photos and videos.

In total, your personal life is exposed, and it’s only limited by the hacker’s imagination what he can do with all that data.

What this means for your safety

This is a disastrous finding on two levels. In the broader sense, it’s disastrous that any app that participates in user data would have these wide-open vulnerabilities that make it particularly easy for hackers and government agencies to monitor user communications.

For a VPN app to be so vulnerable is a betrayal of users’ trust and puts them in a worse position than if they hadn’t used any VPN at all.

In a more specific, and more dangerous, sense, it’s disastrous that a VPN would have these vulnerabilities. After all, users are connecting to VPNs in order to increase their privacy and security. For that reason, they’re more willing to transmit sensitive information on VPN apps than on other apps. For a VPN app to then be so vulnerable is a betrayal of users’ trust and puts them in a worse position than if they hadn’t used any VPN at all.

However, there could be something larger at play here. When looking at these apps together, there seem to be two essential possibilities:

1. These core vulnerabilities are intentional for these free VPN apps. After all, since a successful MITM attack would allow someone the ability to monitor sensitive user data (or reroute users to fake VPN servers) without the user’s knowledge, that’s a useful tool for any surveillance-hungry organization or nation.
2. On the other hand, we should probably not attribute to malice what can be explained by stupidity – or here, laziness. In simple terms, the app developers here are so focused on getting high amounts of users and stuffing their app with ads, that they placed lower priority on the core security features of their apps.

While one possibility may seem worse than another, at some point only the result matters: people using these vulnerable apps are putting their data – and possibly their lives – in danger.

Based on that essential fact alone, we highly recommend users avoid these vulnerable VPN apps at all costs. When looking for an effective VPN, we recommend users do their due diligence. Ask yourself the following questions:

• Do I know this VPN developer or brand? Do they seem trustworthy?
• Where is the VPN located? Is it in a privacy-friendly country?
• For mobile apps, what permissions are they requiring? Do they actually need those permissions to function (such as the camera, GPS, microphone)?
• Free is great – but can you trust this VPN? There are a few commendable free VPNs or VPNs with free options from reputable brands.

Taking an active role in filtering out the good VPNs from the bad ones will save users a lot of trouble later on.

 

 

Source

[zigzag]

Users got what they paid for.

I use VPN only for geo restricted content.

I don't trust VPN companies with important data.

 

[aliyx]

https://reports.exodus-privacy.eu.org/en/reports/98302/

NordVPN App have

5 trackers

We have found code signature of the following trackers in the application:

AppsFlyer

Google Analytics

Google CrashLytics

Google Firebase Analytics

Google Tag Manager

A tracker is a piece of software meant to collect data about you or your usages.

 

12 permissions

We have found the following permissions in the application:

ACCESS_NETWORK_STATE view network connections

ACCESS_WIFI_STATE view Wi-Fi connections

FOREGROUND_SERVICE run foreground service

INTERNET have full network access

RECEIVE_BOOT_COMPLETED run at startup

WAKE_LOCK prevent phone from sleeping

INSTALL_SHORTCUT install shortcuts

BILLING

CHECK_LICENSE

RECEIVE

BIND_GET_INSTALL_REFERRER_SERVICE

C2D_MESSAGE

[aliyx]

εxodus

The privacy audit platform for Android applications

ExpressVPN

2 trackers

10 permissions

Version 7.9.8 - see other versions
Report created on Feb. 28, 2020, 7:08 p.m.

See on Google Play

2 trackers

We have found code signature of the following trackers in the application:

Google CrashLytics

Google Firebase Analytics

A tracker is a piece of software meant to collect data about you or your usages. Learn more...

10 permissions

We have found the following permissions in the application:

ACCESS_NETWORK_STATE view network connections

ACCESS_WIFI_STATE view Wi-Fi connections

FOREGROUND_SERVICE run foreground service

INTERNET have full network access

RECEIVE_BOOT_COMPLETED run at startup

VIBRATE control vibration

WAKE_LOCK prevent phone from sleeping

BILLING

RECEIVE

BIND_GET_INSTALL_REFERRER_SERVICE