Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

Researchers presented MVPNalyzer results showing that many popular free Android VPN apps fail basic security and privacy functions: 29 apps leaked network traffic (including DNS), six leaked full browsing traffic, five downloaded VPN configuration files in cleartext enabling tunnel hijacking (five apps named), many apps leaked advertising IDs and device fingerprints, and numerous OpenVPN configs used weak or no encryption. These issues affect apps with billions of installs, fixes are inconsistent, and the researchers plan to release the auditing tool to help app stores and regulators detect such problems.