Research by Metric Labs Top10VPN has confirmed that over 50% of the most popular free personal VPN (Virtual Private Network) services are run by secretive companies based in China. With unacceptable privacy policies and a lack of accountability, the report strongly advises individuals not to trust these services to protect their internet privacy.
VPN is one of the most searched terms on mobile devices
The need for personal privacy and growing awareness of cyber attack is driving an unprecedented demand for applications that deliver secure access to the internet. Google statistics show that after social apps and games, VPN’s are the most searched for apps on mobile devices throughout the world. Apps such as TurboVPN, Snap VPN and VPN Proxy Master have been installed for free on millions of Android and IOS devices.
What is a virtual private network?
A VPN or Virtual Private Network is a private network that extends across a public network and enables users to send and receive data in the strictest confidence. To ensure security, the private network connection is established using an encrypted layered tunnelling protocol. Users gain access to the VPN with authentication methods that include passwords, 2FA and security certificates. VPNs can be either remote-access (connecting a computer to a network) or site-to-site (connecting two networks). In a corporate setting, remote-access VPNs allow employees to access their company’s intranet from home or while travelling outside the office and site-to-site.
Why is a personal VPN used?
Individuals use personal VPN services for the following reasons:
- Keeping internet activity private from any other individual or organisation
- Remaining anonymous by using a different IP address
- Protection from cyber attack when using public WiFi access
- Evading censorship from local and national organisations (schools, prisons, countries)
It is clearly important that users choose their personal VPN service carefully. An unscrupulous provider could observe and tamper with any web browser or internet activity. They could also be a willing or unknowing agent in the delivery of a DNS or malware-based cyber attack.
Metric Labs Top10VPN report
Metric Labs Top10VPN identified the top 30 free apps displayed in the search results for “VPN” in the App Store and Play Store for UK and US locations. They then determined the number of Android/IOS installs, company location, privacy policy and customer support response for each service.
Simon Migliano, Head of Research, Metric Labs, commented, “It was often very challenging to verify who was actually behind these VPN apps, due to the great lengths companies went to in order to hide their ultimate ownership, and far beyond the means of the typical consumer to discover.”
The summary from the report highlights:
- 59% of apps have links to China (17 apps)
- 86% of apps had unacceptable privacy policies (no policy at all, limited accountability)
- 64% of apps had no dedicated website
- 83% of app customer support email requests were ignored
The dominance of Chinese service providers is not surprising given the strict internet censorship applied by the Chinese government in recent years. Ironically, VPN providers in China must be registered with their government. This further reinforces the view of some, that the Chinese government might be directly involved in the ‘global surveillance’ of millions of mobile device users.
Using personal devices for work
The use of their own mobile devices (BYOD) by employees for work purposes is growing rapidly in UK SME companies. This particularly applies to senior managers and partners of professional services firms in private equity, legal and accountancy sectors. We always advise our clients to protect their mobile devices with company VPN or cloud application (e.g. Office 365) encryption services. The disadvantages of this approach are that it can make access to business applications slower and some users get frustrated in having to keep their private data separate from their ‘business’ data.
Many individuals, however, do use their mobile devices casually both for private and business use. This will include browsing the internet and sending a quick business email from a personal email address. While the use of a personal VPN service may make some sense for these users, I would advise they take great care in choosing a provider who is reputable, trustworthy and accountable.
—————–
Wizard Cyber Is a specialist in the provision of secure remote access solutions that allow the safe use of the internet for personal and business reasons. We particularly focus on the needs of smaller professional services firms and can advise on the policies and technology required to enable staff to use their own devices securely for work purposes.
