Slashdot Mirror
Viruses, Spyware Found in 'Alarming' Number of Android VPN Apps (abc.net.au)
When the Federal Court blocked access to file-sharing websites like The Pirate Bay last December, VPN (Virtual Private Network) providers reported a surge in subscription rates. Australian company Vanished VPN said its subscription rates had doubled in the past six months and VPN Unlimited said it had seen a 12.5 percent monthly jump since the court's decision. People were using VPN services to access the blocked sites because they masked their location -- allowing users to get around any website blocks or restrictions. But if you're one of those people, you might want to take a closer look at the service you're using -- especially if you've got an Android device. From a report: A team from CSIRO's Data 61, University of NSW and UC Berkley in the US found a whole bunch of Android VPN apps contain viruses, spyware and other adware. Researchers analyzed the apps available for Android to look for nasties like trojans, spyware and adware -- giving each an "anti-virus rank (AV)" based on what they found. The lower the rank, the better. They found of the 283 apps they analyzed, 38 percent contained malware or malvertising (malicious advertising containing viruses).
So why don't people just use the built in VPN client?
How many of the 38% can be found in the Play Store and how many can be found in F-Droid?
OpenVPN has clients for both iOS and Android. The Android client source is open, allowing for code review. Unfortunately, due to NDA with Apple, the iOS source isn't as open, but it is written by the same people that write the open source OpenVPN code.
Question - Good android Virus\Spyware scanner?
they can litterally watch data(depending) and all connections if they wanted and log them. any apps can have malware its about trusting the source in this case google which tries to mitigate that sort of thing.
Maybe we should all just go back to hardwired landline phones, answering machines, and writing letters on actual paper and mailing them. All this shit is so out of control, and it's a perpetual game of Whac-A-Mole trying to secure it all, a game we'll never win.
Email that's 95% SPAM.. overengineered webpages.. constantly having one screen or another in front of your face.. continual sensory overload.. fake 'online friends' you'll never meet.. so-called 'social media' that claims to 'bring people together' when all it does is give us an excuse to not practice our actual social skills, instead staying away from people.. disregarding the Social Contract entirely, becoming like mean-spirited, spoilled-brat children online, being shitty to people -- then having that Bad Behavior spill over into what little actual, in-real-life social contact you have, so we're shitty to everyone, everywhere, all the time.. rush, rush, rush everywhere.. isn't it enough already? Is all this gods-be-damned tech actually making our lives better, or is it just distracting us from the real problems, just being the Shiny Thing that makes us forget the important things? Can't we just forget all this crap, actually connect, and come back to the reality that we're actual, social creatures, and that we need to be nice to each other?
Oh, forget it. I know nobody gives a damn anymore.
Link to the original paper instead of a news article: An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps
@cyberrecce
The article is not very clear as to from where these VPN apps are being downloaded.
Are these (or were these) apps available on Google's/Android's native App store, or did the user have to enable a third-party repository to get these programs?
If the former, this is a fairly serious indictment of Google's policies, which should not only check to see if publishers are loading up their apps with spyware/trojans, but also determine a basic fitness test on the program (does it actually do what they say it does)? This is the whole point of using a curated market and if Google isn't even performing this sort of basic filtering, then they have seriously dropped the ball.
If the users are downloading from an unvetted third-party repository, well... there is a reason Google warns against this. There are some trusted third-party markets, but if a vendor asks you to allow their repository, it should immediately raise red flags and make you look more closely at their offerings.
If your VPN service provider does not support OpenVPN, GET ANOTHER SERVICE PROVIDER.
There is no excuse for not supporting OpenVPN in this day and age.
don't need a VPN to get around the pirate bay blocks, just set your DNS to 8.8.8.8
"Viruses, Spyware Found in 'Alarming' Number of Android VPN Apps"
Users download applications and ignore the list of permissions the app is asking for. One morning we are going to wake up and see the mother of all botnets using millions of phones running Android. The smart phone platforms are doing the same thing that developers did with early desktop applications and operating systems. Security was ignored in favor of faster development.
As a general rule: The shorter the better. If it says "we log nothing. Never.", you're pretty safe, because only law applies and they do not reserve further rights. If it says "we reserve the right to monitor, if we suspect abuse ...", its up to them to define abuse and reasons why they might suspect it.
Other red flags are untrue claims (most secure of the world, unbreakable, stops ALL tracking (so? spyware, fingerprinting, etc.?)), technical incompetence (telling the connection after their exit node would be encrypted), scaremongering like "YOU ARE LIVING IN [your providers city], AND EVERYBODY CAN ACCESS YOUR DATA WITHOUT OUR VPN", free vpns (there is no such thing as a free lunch) and other things, which are too good to be true.
Looking at the android app is now another sign, which can help you to rate the vpn, even when you're not using android.
Even the Cisco Anyconnect VPN client for the desktop has telemetry built-in. It cannot be disabled or removed.
Anyone know where the complete list of VPN ratings are? Worst 10 is a nice start, but the whole list would be even better. Thanks.