MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs

MVPNalyzer: An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs

Speakers: Wayne Wang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=2YAMggHCfPk

Overview

VPN providers promise absolute security and privacy with the click of a button, but a large-scale audit of 281 free mobile VPN apps from the Google Play Store reveals that this promise is overwhelmingly broken. Using MVPNalyzer, a semi-automated dynamic analysis framework, researchers from the University of Michigan and the University of New Mexico found that 247 of 281 apps (88%) exhibited at least one security or privacy deficiency, and 144 (51%) exhibited more than one. These are not obscure apps -- collectively they represent over 2.4 billion installs.

The findings are damning: five apps retrieve OpenVPN configuration files in plain text over HTTP (enabling traffic redirection attacks), 29 apps leak visited websites, 76 transmit advertising IDs enabling persistent cross-app tracking, and only one out of 108 apps that stored OpenVPN configuration files followed best practices. The researchers successfully demonstrated a traffic redirection attack against apps that fetch OpenVPN configs over HTTP, proving these are not theoretical concerns.

Background

▶ Watch: VPN trust model and prior security breakdowns (0:00)

VPNs are designed to route user traffic through a secure encrypted tunnel to a remote server, shielding it from network observers and hiding source IP addresses from destination servers. However, in doing so, they shift visibility and control over user traffic to the VPN provider, making the provider a critical trust point. Prior academic work has repeatedly highlighted security breakdowns across virtually every stage of the VPN lifecycle -- from misconfigurations and cleartext communications to server-side vulnerabilities -- but most studies focused on single aspects in isolation, often specifically on desktop VPNs.

The last comprehensive multi-dimensional study of mobile VPNs was published nearly a decade ago. Since then, mobile devices have surpassed desktops as the dominant internet access method, accounting for roughly 60% of global web traffic. Investigating mobile VPNs brings unique challenges: the tension between authentic app behavior and analysis observability (rooting changes app behavior, many apps detect emulators and debuggers), scalability across hundreds of apps with diverse UIs, and Android's limitation of one active VPN at a time, which restricts parallel testing.

Key Findings

▶ Watch: Five key audit questions for VPNs as secure tunnels (4:00)

MVPNalyzer evaluated five key security questions across 281 mobile VPN apps:

Cleartext Communications: 61 apps made cleartext HTTP requests to 64 unique URLs. 105 of these URLs contained "VPN" or referenced the app name, suggesting communication with backend infrastructure. Most seriously, five apps retrieve OpenVPN configuration files in plain text, allowing a network attacker to modify these files and redirect all VPN traffic to an attacker-controlled server -- an attack the researchers successfully executed.

Traffic Leakage: 29 apps leak visited websites. 24 apps leak DNS queries outside the tunnel, with most continuing to use the default ISP resolver. Six apps recognized the risk of ISP resolvers and switched to public resolvers but still sent DNS queries outside the tunnel where they could be observed. Six apps do not tunnel browser traffic at all, and four apps use entirely unencrypted tunnels.

Obfuscation Failures: 169 apps are trivially identifiable as VPNs using standard deep packet inspection. 117 use unobfuscated protocols (OpenVPN, WireGuard, IPSec), 54 use standard ports, and 101 communicate with clearly VPN-related domains. Critically, 110 of these apps explicitly advertise censorship circumvention, making obfuscation resistance an inherent requirement they fail to deliver.

Tracking and Fingerprinting: 76 apps transmit the advertising ID, a unique device identifier enabling persistent cross-app tracking. 42 transmit fine-grained location data (coordinates, IP address, or city). Over 200 send device attributes (make, model, screen size) that can be combined for device fingerprinting.

Tunnel Misconfiguration: Of 108 apps storing OpenVPN configuration files, only one followed best practices. Most rely on single-factor authentication. 11 apps configure OpenVPN in ways that can disable encryption entirely depending on the OpenVPN version. Nine apps disable data integrity and authenticity checks, weakening protection against man-in-the-middle attacks.

Technical Deep Dive

▶ Watch: Plaintext OpenVPN configs and traffic redirection attack (8:00)

MVPNalyzer is an extensible semi-automated dynamic analysis framework with three core modules operating across a rooted Android phone connected via USB to a computer (multiple phones can be managed in parallel):

Data Collection: Runs directly on the mobile device. The framework launches the VPN app alongside monitoring processes that capture all VPN traffic, TLS keys (for later decryption), and app storage directories. By focusing on where apps interact with the OS -- the network and file system -- rather than internal source code, the framework scales across diverse VPN implementations. The only manual step is UI interaction to establish the VPN tunnel (including watching ads and confirming consent dialogs). Once connected, MVPNalyzer automatically visits 50 popular websites over a 5-minute period.

Data Processing: Converts raw data into analysis-ready formats: filtering non-VPN traffic from packet captures, decrypting TLS flows using captured keys, and extracting OpenVPN configuration files from app storage directories.

Data Analysis: Applies automated analysis to answer the five key security questions. For the traffic redirection attack, the researchers demonstrated that apps fetching OpenVPN configs over HTTP allow a man-in-the-middle attacker to substitute a modified config file that points the VPN tunnel to an attacker-controlled server, effectively giving the attacker full visibility into all "protected" traffic.

The framework was tested against 281 functional, free-to-use VPN apps collected from Google Play Store search results for 40 VPN-related phrases, all running on Android 14.

Demo / Proof of Concept

▶ Watch: Only 1 of 108 OpenVPN configs follows best practices (10:00)

The researchers successfully carried out a traffic redirection attack against VPN apps that fetch OpenVPN configuration files over cleartext HTTP. By intercepting the HTTP response and substituting a modified OpenVPN config file, they redirected the VPN tunnel to a server under their control, gaining complete visibility over the user's "protected" traffic. This attack was demonstrated against the five apps identified as transmitting OpenVPN configs in plaintext.

The attack is particularly devastating because the user has no indication that anything is wrong -- the VPN app appears to be functioning normally, showing a connected status, while all traffic flows through the attacker's server instead of the legitimate VPN endpoint.

Defensive Implications

▶ Watch: Q&A: Should regulation replace voluntary transparency? (16:00)

The researchers propose a multi-layered approach to improving mobile VPN security:

Platform-Level Enforcement: Android already disallows cleartext HTTP over high-level networking APIs by default, but developers can override this by toggling manifest flags. VPN apps that do so should be rejected from the Play Store. Eight apps bypass cleartext protections using low-level socket APIs. Android's existing detectCleartextNetwork development API, which inspects packets for TLS record headers, could be enforced on regular user devices.

VPN API Separation: The Android VPN API is used not just by traditional VPNs but by DNS changers, antivirus tools, and proxies. This creates user confusion about what an app actually does. Clearer separation between VPN functionality and other networking tools would help users understand what protection they're actually receiving.

Proactive Auditing: Google Play Store's current transparency mechanisms -- the self-reported data safety section and the voluntary verified badge (which costs $3,000-$6,000 and requires minimum installs/reviews) -- are insufficient. By the time an app qualifies for the verified badge, significant harm may already have been done. MVPNalyzer-style testing should be performed before apps are approved for distribution.

Developer Responsibility: All findings were reported to developers. Response rates were low. A few acknowledged the issues as mistakes and committed to fixes, but most did not respond. The presenter characterized most issues as negligence rather than design choices.

Key Takeaways

• 88% of 281 tested mobile VPN apps (representing 2.4 billion installs) have at least one security or privacy deficiency
• Five apps fetch OpenVPN configs over plaintext HTTP, enabling demonstrated traffic redirection attacks
• Only 1 of 108 apps with OpenVPN configs followed best practices; 11 can disable encryption entirely
• 76 apps transmit advertising IDs for cross-app tracking; 42 transmit fine-grained location data -- directly contradicting privacy promises
• 110 apps claim censorship circumvention capability but are trivially identifiable as VPNs via standard deep packet inspection
• Google Play Store needs proactive VPN-specific auditing before app approval, not just voluntary post-hoc transparency badges

About the Speaker(s)

Wayne Wang (presenting as Aaron Artwine) is a researcher from the University of Michigan, working in collaboration with the University of New Mexico. This work builds on the group's prior VPN Analyzer framework for desktop VPNs, extending investigative capabilities to the mobile landscape. The team has a strong track record in VPN security research and engaged in responsible disclosure with all affected developers.