More than 40% of all free Android VPNs are leaking personal data

ProPrivacy report suggests that millions of Android VPN users could be leaking personal information

Highlights

• 40% of all free VPNs in the Google Play Store leak personally identifiable information
• 81.4 million downloads of defective apps
• Millions of users worldwide could be at risk
• Developers creating multiple versions of defective apps
• ProPrivacy has launched a free & fully automated leak testing tool to help combat the rise in poor quality services

ProPrivacy analyzed the top 250 free VPN apps in the Google Play Store and found that more than 40% failed to adequately protect users’ privacy. Collectively, these apps, which falsely profess to protect privacy, represent some 81.4 million downloads.

VPN technology was once viewed as a niche product, used by the fringe members of society to shield malicious activity, but this is no longer the case.

The public’s relationship with digital privacy is changing. A number of watershed moments have occurred over the years; from the Edward Snowden revelations in 2013 to the Cambridge Analytica scandal in 2019, consumers have become acutely aware that their privacy is facing unprecedented attacks.

In March 2017, the US administration and FCC completely dismantled consumer privacy protections, allowing ISPs to track customers and sell data to third parties. This proved a tipping point and saw sharp increases in VPN uptake across the US. 

The growing awareness of digital privacy has created a hugely lucrative opportunity. The combined VPN market is projected to reach in excess of US$50 billion by 2024, up from US$34 billion in 2018.

Consumer VPNs have been downloaded more than 1.25 billion times on the Google Play Store alone. Collectively, that’s more than Twitter, Snapchat, Skype and Microsoft Word.

VPNs have become big business, and everyone wants a piece of the pie. As is so often the case with high growth markets, there are also opportunists willing to take advantage of burgeoning consumer demand.

Investigation: How many free Android VPNs really work?

Consumer VPNs serve multiple purposes and are used by different people for different reasons. They are able to circumvent geo-restricted content, and this has made them enormously popular for accessing services like Netflix, which restricts much of its content based on region.

However, as their name suggests, their core function is to protect and maintain the privacy of the individual using the service. A VPN provider must be able to meet the technical challenges involved with masking the identity of its users. From privacy-conscious citizens at one of the spectrum to dissidents, journalists and whistleblowers at the other, people rely on VPNs to work. If it fails to meet basic technical requirements, the real-world consequences can be dire.

The costs involved with building and maintaining quality VPN infrastructure as well as a software client capable of safeguarding users are significant. In order to provide a sustainable, reliable and trustworthy service, these costs are almost always passed on to users in the form of subscriptions. There are a number of trustworthy services that do provide free plans, but these are generally paired with a premium plan and restricted in the form of bandwidth or data limits.

Despite the costs involved with building a functional service, mobile marketplaces are littered with VPN services purporting to be ‘free’. In some cases, these apps are often used as a vehicle for legitimate advertising. In more sinister cases, they are honeypots, designed to harvest data to be sold on to third parties.

What we wanted to understand was if these applications worked at a technical level, so we carried out the most extensive audit of the Android VPN application market to date.

The Google Play Store is the largest mobile marketplace of its kind, with some 3.16 million apps available to consumers, nearly double Apple’s App Store (1.79 million).

We identified 4,970 VPN apps in the Google Play Store (included at bottom of report); however, the Google Play Store only pulls the top 250 apps based on any given query, so it was these apps that became the focus of the investigation.

Of those, 32 were premium (paid) services and were therefore discounted from analyzes. A further 14 were discounted as they were either not bona fide VPN services or could not be installed.

The remaining 204 VPNs were then installed in sandbox environments and extensively tested for a range of leaks using both IPv4 and IPv6 connections.

The results were disturbing. Four in every ten VPNs tested had a leak. In total, we found 82 VPNs out of the 204 tested either did not provide an IPv4 address and could therefore not be deemed functional or were leaking data via IPv6 and/or WebRTC.

Leaking VPN apps by number of downloads

The rise of IPv6 and the impact on VPNs

The Internet Protocol (IP) is the foundation of the web. Every device is identified through its own IP address in order for internet communication to work.

The previous version of the protocol, IPv4, used a 32-bit addressing scheme, capable of supporting 4.3 billion devices. However, it became apparent more than 20 years ago that the internet was destined to grow beyond this limit and in 1998, the IETF created IPv6, which uses 128-bit addressing to support approximately 340 trillion trillion (or 2 to the 128th power) devices. 

Many ISPs, websites and services still do not support IPv6. This is why many VPN service providers have neglected to address how IPv6 connections should be handled. However, IPv6 connectivity is on the rise. Data provided by Google suggests that between 25 and 30 percent of all its traffic is now IPv6.

Source: Google

High-quality VPN clients offer IPv6 leak protection. In most cases, this is done by disabling IPv6 at the system level to ensure IPv6 connections are simply not possible. A growing number of quality VPN providers now route IPv6 connections through the VPN interface. 

Almost all (87 percent) of the leaks were related to IPv6, suggesting that Android developers are not mitigating against the growth of IPv6. 

A further nine VPNs displayed WebRTC leaks. These services included two providers with over 5 million downloads each.

Based on average global adoption figures of the IPv6 standard, combined with the total number of monthly downloads, we estimate that as many as 39 million users have potentially leaked personal information over IPv6.

Developers releasing multiple versions of the same VPN

Another disturbing trend observed during testing was clusters of VPNs. Developers are releasing multiple instances of the same VPN under different names in order to capture as much traffic as possible. The VPNs use the same infrastructure, the same IP pools and the same client, but target different search terms within the Play Store.

There were also instances of multiple developer accounts using the same VPN infrastructure and client (app). In the most extreme case, we identified 141 VPNs, across three different developer accounts, all operating on the same flawed infrastructure. Collectively, these apps had some 100,000 downloads.

Introducing the ProPrivacy Leak Test Tool

Protecting privacy by empowering VPN users 

The problem with VPN leaks is that they are not apparent to the end-user. For all intents and purposes, a VPN app can appear to be 100% operational and the user will not be aware that they are leaking potentially sensitive data.

For some users, this may be an acceptable risk. For others, such as those living under authoritarian regimes, the impact of a non-functioning VPN can be profound.  

Our research suggests that some 39 million users worldwide have been impacted by these leaks in the Android ecosystem alone.

There are ways of testing VPNs to ensure they are properly protecting a user’s privacy, but without sufficient knowledge of the specific types of leaks and how to interpret the data, it can be difficult for the average consumer to verify the integrity of their chosen app.

To combat the growing number of leaks we’re seeing, particularly in mobile marketplaces, ProPrivacy has launched the first fully automated leak testing tool.

The web app holds the user’s hand through each step of the testing process and has fail-safes built in the minimize user error.

The results are presented in an easy-to-understand report that offers the user advice should a leak be detected.

Our hope is that, by removing some of the friction involved with testing for leaks, users will be empowered to demand more from their VPN and, in turn, providers will be incentivized to create quality products that meet the basic requirements of their customers.  

You can access the ProPrivacy Leak Test Tool on any device or platform now.