By rssfeeds-admin 
A new disclosure of widespread security and privacy failures across popular Android VPN applications, revealing that dozens of apps transmit sensitive data in plaintext and fail to deliver the fundamental protections users expect.
Researchers from the University of Michigan and the University of New Mexico developed MVPNalyzer, an extensible framework designed to systematically audit Android VPN apps across network layers, addressing platform-specific challenges such as Android’s restrictive VpnService API and certificate pinning.
The framework uses LD_PRELOAD-based function hooking to decrypt TLS traffic, socket statistics for traffic attribution, and custom Zeek/Spicy parsers to inspect unencrypted content and configuration files.
281 Google Play VPN Apps Expose Sensitive Information
Wayne team applied this system to 281 popular, free VPN apps sourced from Google Play Store searches and tested them on physical Android 14 devices.
The analysis found that 61 apps transmitted unencrypted data across 10,552 flows, with the worst offender, com.kylovpn, sending over 2,000 cleartext flows.
Most alarming, 5 apps transmitted VPN configuration files in cleartext, a flaw that lets a network-adjacent attacker modify the file in transit and redirect the victim to an attacker-controlled VPN server, a tunnel-hijacking attack the researchers say they successfully demonstrated in practice.
Notably, 8 of the 61 apps bypassed Android’s built-in cleartext-blocking protections entirely by using low-level socket APIs that cannot enforce encryption policies.
Beyond cleartext exposure, 29 apps leaked user traffic outside the VPN tunnel: 24 leaked DNS queries (affecting a combined 360 million installs), 6 leaked browser traffic via visible TLS SNI fields, and 4 tunneled data over unencrypted transport protocols.
Separately, 169 apps were trivially detectable via standard ports, protocol signatures, or “vpn”-containing domain strings, undermining the anti-censorship claims made by 110 of those apps in their Play Store descriptions.
The study also flagged extensive tracking behavior and insecure VPN configurations, summarized below:
| Issue Category | Apps Affected | Key Detail |
|---|---|---|
| Advertising ID exfiltration | 76 apps | Persistent device-tracking identifier sent to third parties |
| Ad/tracker contact | 246 apps (~88%) | Contacted 3,714 unique advertising/tracking URLs |
| Insecure VPN config practices | 107 of 108 apps with config files | Only 1 app followed all security best practices |
| Weak authentication | 96 apps | Rely on a single auth factor (cert or password only) |
| Missing server verification | 84 apps | No use of peer-fingerprint or verify-tls directives |
| Disabled HMAC integrity checks | 98 configs | Vulnerable to man-in-the-middle traffic tampering |
Collectively, the flawed apps identified across all five analysis categories have accumulated hundreds of millions of installs, with the insecure-configuration group alone linked to over 601 million installs.
NDSS stated that the tunnel-hijacking vulnerabilities affect all five affected providers on a priority basis; two acknowledged the report and pledged to switch to HTTPS with proper certificate validation for configuration file delivery.
They argue the findings point to systemic developer negligence, poor enforcement of Android’s cleartext-blocking mechanisms, and inadequate maintenance of security-critical VPN configuration files across the mobile VPN ecosystem.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
The post 281 Google Play VPN Apps Expose Sensitive Information Through Cleartext Data Transmission appeared first on Cyber Security News.
Discover more from RSS Feeds Cloud
Subscribe to get the latest posts sent to your email.