Viruses, Spyware Found in 'Alarming' Number of Android VPN Apps (abc.net.au)

When the Federal Court blocked access to file-sharing websites like The Pirate Bay last December, VPN (Virtual Private Network) providers reported a surge in subscription rates. Australian company Vanished VPN said its subscription rates had doubled in the past six months and VPN Unlimited said it had seen a 12.5 percent monthly jump since the court's decision. People were using VPN services to access the blocked sites because they masked their location -- allowing users to get around any website blocks or restrictions. But if you're one of those people, you might want to take a closer look at the service you're using -- especially if you've got an Android device. From a report: A team from CSIRO's Data 61, University of NSW and UC Berkley in the US found a whole bunch of Android VPN apps contain viruses, spyware and other adware. Researchers analyzed the apps available for Android to look for nasties like trojans, spyware and adware -- giving each an "anti-virus rank (AV)" based on what they found. The lower the rank, the better. They found of the 283 apps they analyzed, 38 percent contained malware or malvertising (malicious advertising containing viruses).

Comments

Built in VPN client

[Anonymous Coward]

So why don't people just use the built in VPN client?

Re:Built in VPN client

[DickBreath]

Yes! That!

How to Use Android’s Wi-Fi Assistant to Safely Connect to Public Wi-Fi Networks (and Save Data)

There is no need for a third party VPN app. Just use the Google managed VPN in Android. This can be used automatically when you use a public WiFi hotspot.

Manager: how do you measure leadership?
Tech: with a suitably designed test instrument.

Re:Built in VPN client

[arielCo]

Because the mal-service providers don't use standard VPN protocols - their service, their app.

Re:Built in VPN client

[Anonymous Coward]

What the article fails to mention is that all those "VPN" apps offer the VPN connection for free, something I think most of slashdot would not assume. And of course, they're certainly not doing it for free out of the goodness of their hearts...

Re:Built in VPN client

[fuzzyfuzzyfungus]

Which is, of course, the second(and perhaps larger) problem in this case:

A VPN is a wonderful thing in terms of keeping undesirables out of the traffic between the endpoint device and the VPN provider(with some limited exceptions involving faulty implementation, obsolete protocols, or sneaky traffic analysis of unpadded VPN links); but whoever is terminating the VPN for you is a very, very, trusted party.

If your provider is so sleazy that there is malware in the client you are definitely screwed; but even if the client is clean, they unavoidably see all the traffic sent over the VPN link; and you usually only bother with a VPN because either some of your applications don't encrypt their traffic properly; or because you don't want to reveal to the local wifi hotspot operator what hosts you are communicating with. If the VPN operator is shady; all you've done is add some latency and computational overhead in order to allow a different malicious party to watch your network traffic(and potentially modify it). Even better, while wifi hotspots are managed by zillions of different people and companies, making it somewhat harder to aggregate tracking data for a given user across all the APs they use; you voluntarily connect to your VPN provider; so they get all your traffic no matter where you are.

Honestly, given the numerous alarming things you can do when you are a man-in-the-middle; I'm a bit surprised that adding local malware(and thus substantially increasing the risk of detection) was seen as a good strategy. If I were running an evil VPN I'd want my client(which pesky AV companies or security researchers might well download and inspect) to be squeaky clean and standard; basically just an idiot-proof wrapper around the system provided VPN protocols; and instead load up the malice, ad/malware injection, etc. on the server side.

Re:Built in VPN client

[tlhIngan]

So why don't people just use the built in VPN client?

Because there may be hundreds of different servers you can connect to?

My VPN provider (IPVanish) has servers in many different countries, and in the larger ones, they often have 3-4 in various geographic regions. This results in a list of 300-400 servers. So they have an app that helps you manage the list - you log in, pick a server and the app goes and installs a configuration to use the native (they support LLTP, PPTP and OpenVPN) VPN client with the desired server.

So their app really helps pre-configure the built in client with whatever server you want (helpful if you want to use Netflix or Hulu, since a few of their servers aren't blocked).

Yes, you can do it yourself, since they give you a list on their webpage, but it's a pain.

Re:Built in VPN client

[thygate]

mod parent up

Re:Built in VPN client

[Ol Olsoc]

Because it is fake. The way we know that things are fake is that we see them on teh computer screen.

and everything I say or write is a lie.

Re:Built in VPN client

[unrtst]

AFAICT, the Wi-Fi assistant is only available on android 5.1 nexus devices (ex. galaxy S6 has no support for it).

There's always OpenVPN

[mnslinky]

OpenVPN has clients for both iOS and Android. The Android client source is open, allowing for code review. Unfortunately, due to NDA with Apple, the iOS source isn't as open, but it is written by the same people that write the open source OpenVPN code.

Re:There's always OpenVPN

[thegarbz]

That depends on the service doesn't it. OpenVPN is a client / server. Whether or not you can use it for your service is an entirely different question.

Re:There's always OpenVPN

[mnslinky]

I failed in my original post to plug my books about OpenVPN:

* Mastering OpenVPN: https://www.packtpub.com/netwo...
* Troubleshooting OpenVPN: https://www.packtpub.com/netwo...

Link to Paper

[InfectedPacket]

Link to the original paper instead of a news article: An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps

Source of the apps

[Somebody Is Using My]

The article is not very clear as to from where these VPN apps are being downloaded.

Are these (or were these) apps available on Google's/Android's native App store, or did the user have to enable a third-party repository to get these programs?

If the former, this is a fairly serious indictment of Google's policies, which should not only check to see if publishers are loading up their apps with spyware/trojans, but also determine a basic fitness test on the program (does it actually do what they say it does)? This is the whole point of using a curated market and if Google isn't even performing this sort of basic filtering, then they have seriously dropped the ball.

If the users are downloading from an unvetted third-party repository, well... there is a reason Google warns against this. There are some trusted third-party markets, but if a vendor asks you to allow their repository, it should immediately raise red flags and make you look more closely at their offerings.

Re:Source of the apps

[GuB-42]

The study was done on Google Play apps. The worst offenders were removed from the Play Store during the study.
It isn't explicit what counts as "malware", but for the look of it, beside a couple of apps (from the removed ones), it looks more like obnoxious ads.

Maybe more concerning than malware is the lack of security. Some apps don't even encrypt traffic.

Always use OpenVPN

[Kludge]

If your VPN service provider does not support OpenVPN, GET ANOTHER SERVICE PROVIDER.
There is no excuse for not supporting OpenVPN in this day and age.

Re:Always use OpenVPN

[b0bby]

As far as I am aware, OpenVPN is secure and can be open source on both servers and clients. I use it regularly and find it works well. What is your objection to it?

Re:Always use OpenVPN

[allo]

two things:

1) There are possiblities around this. Changing ports, using tcp instead of udp, and even some proprietary solutions, faking https and so on.
2) You do not neccesarily need to use openvpn. But if your provider doesn't offer openvpn, its no serious provider.

Re:Always use OpenVPN

[thegarbz]

There is no excuse for not supporting OpenVPN in this day and age.

This day and age? What day and age is that? The day and age of telemetry? The day and age of custom protocols? The day and age of vendor lockin?

I agree, I do have OpenVPN through my provider, but they didn't provide the config for it. That was a mission in user unfriendliness.

Re:Always use OpenVPN

[thegarbz]

China is that you?

Re:Always use OpenVPN

[Anonymous Coward]

If your VPN service provider doesn't support OpenVPN, then roll your own: fire up a Linode or DigitalOcean instance at your choice of datacenter location and configure OpenVPN with at most a few minutes of tutorial fudging.

Have a look at the ToS and privacy statement

[allo]

As a general rule: The shorter the better. If it says "we log nothing. Never.", you're pretty safe, because only law applies and they do not reserve further rights. If it says "we reserve the right to monitor, if we suspect abuse ...", its up to them to define abuse and reasons why they might suspect it.

Other red flags are untrue claims (most secure of the world, unbreakable, stops ALL tracking (so? spyware, fingerprinting, etc.?)), technical incompetence (telling the connection after their exit node would be encrypted), scaremongering like "YOU ARE LIVING IN [your providers city], AND EVERYBODY CAN ACCESS YOUR DATA WITHOUT OUR VPN", free vpns (there is no such thing as a free lunch) and other things, which are too good to be true.

Looking at the android app is now another sign, which can help you to rate the vpn, even when you're not using android.

Re:Have a look at the ToS and privacy statement

[gnasher719]

As a general rule: The shorter the better. If it says "we log nothing. Never.", you're pretty safe,

You can be pretty sure about what they said. You can't be sure at all about what they are actually doing.

Re:Have a look at the ToS and privacy statement

[allo]

Of course. Trust is important, but you have little chance to actually build trust, except interpreting such signs. A long ToS tells, that they are more willing to cooperate with your enemies and avoid the problem, that you could sue them for not respecting your rights. And a ToS with clauses when they are allowed to monitor traffic are telling you, that they have the means to monitor traffic, while others state, that they do not have such tools prepared (meaning an admin would need to script some tcpdump himself, if they really need to get you).
And sometimes you see an polical mission. Have a look at lavabit and how Levinson rather closed his company than handing out the TLS key. This is the spirit, you're looking for.

Complete list of VPN ratings?

[ottott]

Anyone know where the complete list of VPN ratings are? Worst 10 is a nice start, but the whole list would be even better. Thanks.

Re:Simplify

[AHuxley]

Get a VPN in the only router that can see the internet. Every packet in and out gets wifi VPN. Or ethernet VPN on the desktop.
Any OS or app can then do what it wants. Any media layer, javascript, hidden peer-to-peer connection it all gets VPN.