Google has removed a popular Android VPN from the Play Store after discovering vulnerabilities in the service that could allow hackers to redirect users to malicious servers. SuperVPN, the offending service, has over 100 million installs and was in the top five VPN search results on the Google App Store before it was removed. The VPN contains vulnerabilities that open the door to man-in-the-middle attacks (MITM), which can expose messages sent between the user and the provider and, most importantly, redirect users away from the authentic VPN servers. Rigorous testing has also revealed that the app allows for the delivery of sensitive data over unsecured HTTP. While the information transmitted between the user and the backend is encrypted, the decryption keys are stored in the app itself, making it an easy target for hackers.
SuperVPN privacy issues
SuperVPN has repeatedly criticized its suspicious practices, and the exact origin of the request remains unclear. Its Singapore-based publisher SuperSoftTech is listed, but an investigation into the app's lineage reveals that it belongs to Jinrong Zheng, an indie developer likely based in Beijing. Zheng is also responsible for LinkVPN, which is apparently based in Hong Kong, and is connected to Shenyang Yiyuansu Network Technology, the developer of the app listed against SuperVPN on the Apple app store. SuperVPN was first identified as a security threat in 2016, when Australian researchers ranked it third in an analysis of the most malicious VPN apps, suggesting that the app poses risks since its arrival on the Google Play Store. At this point, it had only been installed 10,000 times. The app's user base has doubled from 50 million to 100 million since January, in line with the sharp increase in VPN usage around the world due to the ongoing pandemic, putting many 'users at risk. The huge increase in installs can also be partly attributed to Google Play Store search ranking manipulation. The publisher would have flooded their page with a large number of fake hidden user reviews and generated illegitimate backlinks to ensure optimal ranking position. Millions of SuperVPN users are advised to immediately remove the app. Via VPNPro