100 Million Android Users Warned Against Using this "Very Dangerous" VPN App

Millions of Android users are being cautioned against using a popular Android VPN that was removed by Google from its Play store. The action was taken by Google after Researchers found vulnerabilities in 'SuperVPN' that could leave devices open to malware attacks and allow attackers to redirect victims onto malicious servers.

As of now, the app has around 100 million downloads, however, in the year 2016 when the risks associated with the app surfaced for the first time ever in related research, it only had a total of 10,000 downloads.

While testing, security researchers identified three main issues with the app:

1. Unencrypted HTTP traffic: The communications can be intercepted by the attackers, it has been said that transferring highly sensitive information over HTTP is not secure at all.

2. Hardcoded encryption keys: The app has inbuilt decryption keys that can easily decrypt the information in an encrypted format.

3. Payload including EAP credentials: EAP credentials are being used by the VPNs therefore users outside the app can not connect to the same server. Hence, EAP credentials sent in the unencrypted payload in a way defeats the purpose.

Notably, SuperVPN was also listed as one of the top 5 VPN in Google Play Store's search results before it was taken down by the authorities. As per the findings by researchers, it contained vulnerabilities that allowed attackers to carry out man-in-the-middle attacks, also known as MITM attacks. It could expose communication that took place between the user and provider letting hackers have access to everything the user is doing online, be it browsing tabs in Chrome, making video calls or loading up apps – all of that sensitive data including passwords, private texts, and voice messages is being made available to the attackers.

Other occasions where SuperVPN drew negative remarks include the app being ranked third by the Australian researchers in an examination of the most malware-rigged VPN apps. The researchers pointed out that the app had been posing risks since it appeared on the Play Store.

While explaining more about the issues, Jan Youngren, Security Researcher at VPNPro told, "SuperVPN used a wide range of shady techniques to help it rank highly in Google, as well as to hide who actually owns the app, where it’s located, and the other apps from the same developer that may have similar issues."

"But lastly, and most importantly, it seems that the entire time the app was on the Play store, it had critical vulnerabilities in one way or another, either by being a vehicle for malware in 2016 or allowing for MITM attacks just before being removed."

"The only thing unclear now is whether these vulnerabilities are due to mistake, or intention. Nonetheless, there are millions of users right now with a dangerous app on their phone. If you’re one of those users, we implore you to delete SuperVPN immediately." He further added.

from E Hacking News - Latest Hacker News and IT Security News https://ift.tt/2Rs5lSl