Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

Summary: Researchers at the University of Michigan, the University of New Mexico, and IIT Delhi tested 281 popular free Android VPN apps with a system called MVPNalyzer and found that the flagged apps have been installed more than 2.4 billion times. 29 apps let traffic leak outside the encrypted tunnel, 61 sent some data in plain text, and five sent their configuration file in the clear, which the researchers confirmed allowed an attacker on the same network to redirect the connection to a server they control.
What's compelling: Five apps remain open to tunnel hijacking on the Play Store even after disclosure, and 246 of the 281 apps contacted known advertising and tracking servers - so the tool people install to avoid being watched is often the thing watching them.

Read the original at The Hacker News ↗