New warning as more than 2 billion app installs are marked as high risk
Despite Google’s best efforts, including plans for Android 15 that seem to be changing, it seems that the warning won’t just go away. Less than a fortnight after an alarming report about the state of malware in the Play Store hit the headlines, here we are again. This time it’s not just malware, it’s broader. And with over 2 billion installs across 100 popular apps, users need to start checking and deleting.
Let’s keep it stupidly simple. Don’t use a free VPN – not now, not ever. For those few who aren’t yet familiar with VPNs, which are still growing in popularity, these apps protect your IP address and browsing activity from your network, ISP, or anyone who might be listening. Applications securely tunnel from your device to a third-party server and from there to the open Internet.
In a world of protests and threats to dissidents, lawyers, activists and journalists, not to mention territories that have banned certain apps and platforms, VPNs are a lifeline. While places like China and Iran block apps arbitrarily, VPNs are the reason users in those countries can still get in.
To work effectively, a VPN needs a network of servers around the world that allow users to either connect to one that is local, or one that can present a location mask and swap the real IP address for one in another country. Live in the UK and connect to a US server, for example, and you can appear to be 3,000 miles from home on the open internet. This doesn’t always work when using apps on your phone, as anyone trying to circumvent geo-broadcasting restrictions might find out. The application on the device can find your location in other ways. There are ways around such blocks, but not for sharing.
Legitimate VPNs charge a fee or come bundled with other paid security products. And yet, most VPNs remain free. And that is one of the great ironies of apps. The free app’s economic business model is to collect your location, device and other data or serve you ads. If you’re lucky. If you’re unlucky, the business model is to infect your phone with malware and steal credentials or private information.
A new warning for the millions and millions of Android users who falsely believe their phones are secure comes from Top10VPN, who just tested the “100 most popular free Android VPN apps on the Google Play Store… with 2.5 billion installs worldwide between them. “, it says aims to “help you avoid using potentially dangerous free VPNs that compromise your privacy and security.”
Spoiler alert – almost every one of these VPNs is a privacy or security disaster, or both.
Just some of the issues the report cites include:
- More than 10% of apps “suffered encryption failures, ranging from completely exposing internet activity to leaking details of visited websites.”
- Nearly 90% of applications “suffered some kind of leak, including 17 VPNs that leaked more than DNS request data,” while more than 50% “showed signs of VPN tunnel instability.”
- Nearly 70% of apps “requested at least one privacy-threatening permission, such as tracking location (20%) and searching for installed apps (46%).
- More than 80% of the apps “included software development kits (SDKs) from marketing or social media platforms. 16 VPNs contained 10 or more of these SDKs.”
- Nearly one in three apps abused permission requests, seeking access to cameras or detailed location information that wasn’t necessary for the app’s core functionality.
- Nearly three-quarters of the apps “shared personal data with third parties such as Facebook, Yandex, and data brokers such as Kochava, including device fingerprints (37 VPNs), IP addresses (23 VPNs), and unique tracking IDs (61 VPNs).
- And most worryingly, “nearly one in five (19%) VPN apps tested were flagged as malware by antivirus scanners,” which is obviously the ultimate irony for a security app.
The sheer scale of VPN usage growth makes these shortcomings critical; Top10VPN comments: “The 100 most popular free VPNs for Android had a total of 260 million installs in 2018. Today, that number exceeds 2.5 billion.” A Forbes report suggests that there are now 1.6 billion VPN users worldwide. And so it’s no surprise that Google has singled out these apps for special treatment through accreditation, which should assure users of the app’s legitimacy.
Here’s a guaranteed list – don’t go over it.
Top10VPN did its own testing by installing each VPN “on very basic, entry-level Samsung smartphones stripped of all but the most basic stock apps” before conducting its tests.
“The results were alarming,” the report warns. “A significant number of these VPN apps are putting our privacy and security at risk due to serious encryption failures and data leaks… While it’s no surprise that most free VPN providers rely on advertising or monetization of their user data to cover costs and hopefully profit, it’s that fundamentally defeats the whole purpose of a VPN.”
It’s not a good look for the Play Store. Simon Migliano, head of research at Top10VPN, told me that “Google doesn’t have a good track record of maintaining a high standard of VPN apps on its Play Store. I first started researching free VPNs for Android in 2018, and if anything, the standard of apps has gotten worse since then. It’s quite telling that 93% of free VPNs for Android in the Play Store had misleading Data Security labels when Google could quite easily enforce its own rules and better protect consumers.”
I’ve reached out to Google for any comment on the report, which makes for confusing reading given the status of this software masquerading in the Play Store’s security aisle. But the details are less important than the takeaways. Don’t use a free VPN, stick to an accredited list and ideally use a well-known, reputable brand. There are cheaper or even almost free options, but the trade-offs severely limit functionality.
If you don’t want to pay any fee, don’t bother with a VPN.
Unfortunately, it really is that simple.