Viruses, Spyware Found in 'Alarming' Number of Android VPN Apps (abc.net.au)

When the Federal Court blocked access to file-sharing websites like The Pirate Bay last December, VPN (Virtual Private Network) providers reported a surge in subscription rates. Australian company Vanished VPN said its subscription rates had doubled in the past six months and VPN Unlimited said it had seen a 12.5 percent monthly jump since the court's decision. People were using VPN services to access the blocked sites because they masked their location -- allowing users to get around any website blocks or restrictions. But if you're one of those people, you might want to take a closer look at the service you're using -- especially if you've got an Android device. From a report: A team from CSIRO's Data 61, University of NSW and UC Berkley in the US found a whole bunch of Android VPN apps contain viruses, spyware and other adware. Researchers analyzed the apps available for Android to look for nasties like trojans, spyware and adware -- giving each an "anti-virus rank (AV)" based on what they found. The lower the rank, the better. They found of the 283 apps they analyzed, 38 percent contained malware or malvertising (malicious advertising containing viruses).

Comments

Built in VPN client

[Anonymous Coward]

So why don't people just use the built in VPN client?

Re:Built in VPN client

[fuzzyfuzzyfungus]

Which is, of course, the second(and perhaps larger) problem in this case:

A VPN is a wonderful thing in terms of keeping undesirables out of the traffic between the endpoint device and the VPN provider(with some limited exceptions involving faulty implementation, obsolete protocols, or sneaky traffic analysis of unpadded VPN links); but whoever is terminating the VPN for you is a very, very, trusted party.

If your provider is so sleazy that there is malware in the client you are definitely screwed; but even if the client is clean, they unavoidably see all the traffic sent over the VPN link; and you usually only bother with a VPN because either some of your applications don't encrypt their traffic properly; or because you don't want to reveal to the local wifi hotspot operator what hosts you are communicating with. If the VPN operator is shady; all you've done is add some latency and computational overhead in order to allow a different malicious party to watch your network traffic(and potentially modify it). Even better, while wifi hotspots are managed by zillions of different people and companies, making it somewhat harder to aggregate tracking data for a given user across all the APs they use; you voluntarily connect to your VPN provider; so they get all your traffic no matter where you are.

Honestly, given the numerous alarming things you can do when you are a man-in-the-middle; I'm a bit surprised that adding local malware(and thus substantially increasing the risk of detection) was seen as a good strategy. If I were running an evil VPN I'd want my client(which pesky AV companies or security researchers might well download and inspect) to be squeaky clean and standard; basically just an idiot-proof wrapper around the system provided VPN protocols; and instead load up the malice, ad/malware injection, etc. on the server side.