When you use a virtual private network (VPN), it prevents your internet service provider from knowing what content or sites you are accessing. In theory.
But a recent analysis of 283 Android VPN-based apps on the Google Play store found more than 80 per cent of apps leak user data, while almost 20 per cent do not encrypt any user data.
More Entertainment News Videos
- Video duration
- 01:28
Animation: How VPNs work
Animation: How VPNs work
Watch this breakdown of how Virtual Private Networks are helping Australians get access to geo-blocked content such as US Netflix.
Up Next
Erin Molan fights back tears
- Video duration
- 01:08
- Video duration
- 01:08
Erin Molan fights back tears
Erin Molan fights back tears
Channel Nine presenter Erin Molan thanks fans for their support during her 'tough week'. Vision: The Footy Show, Channel Nine
Up Next
Eagles sue Hotel California
- Video duration
- 01:10
- Video duration
- 01:10
Eagles sue Hotel California
Eagles sue Hotel California
American soft rock band files a suit accusing the owners of a Mexico hotel of using the name of its hit song, Hotel California.
Up Next
Jimmy Kimmels tearful show opener
- Video duration
- 02:01
- Video duration
- 02:01
Jimmy Kimmels tearful show opener
Jimmy Kimmels tearful show opener
Late night host Jimmy Kimmel recounted an emotional story of his newborn son's open-heart surgery and made a plea for health care coverage for children.
Up Next
Em Rusciano: I can't do this
- Video duration
- 00:30
- Video duration
- 00:30
Em Rusciano: I can't do this
Em Rusciano: I can't do this
The 2Day FM breakfast host whispers "I can't do this" live on air after an awkward exchange with co-host Harley Breen on Tuesday morning.
Up Next
Johnny Depp law suit turns ugly
- Video duration
- 00:53
- Video duration
- 00:53
Johnny Depp law suit turns ugly
Johnny Depp law suit turns ugly
The Hollywood actor's former business managers have accused him of paying a sound engineer to feed him lines on set via a hidden earpiece.
Up Next
Fyre Festival ends in chaos, lawsuit
- Video duration
- 01:42
- Video duration
- 01:42
Fyre Festival ends in chaos, lawsuit
Fyre Festival ends in chaos, lawsuit
A $133 million class action suit has been launched against the organisers of Fyre Festival, after they cancelled the supposedly luxurious Bahamas event at the 11th hour due to poor planning.
Up Next
Heath Ledger scholarship helps Aussies in LA
- Video duration
- 00:59
- Video duration
- 00:59
Heath Ledger scholarship helps Aussies in ...
Heath Ledger scholarship helps Aussies in LA
In a reflection of his generous nature, the Heath Ledger scholarship is designed to help young Australian actors break into Hollywood.
Animation: How VPNs work
Watch this breakdown of how Virtual Private Networks are helping Australians get access to geo-blocked content such as US Netflix.
The research, conducted by a team of researchers from the CSIRO, the University of NSW and the University of California, Berkeley, revealed that in some cases free VPN apps allowed malware or "malvertising" as "a deliberate way to monetise the app," by accessing personal information that could be sold to external partners.
After the team's findings were released, a number of apps were removed from the Google Play store.
"We were not really expecting the magnitude of issues that we found," said Dali Kaafar, a researcher from CSIRO's Data61 unit.
"[It is] spooky behaviour...and surprising that almost one in five apps was not encrypting traffic at all…it was not a VPN tunnel at all, it was a fake tunnel sending all the traffic out."
VPN apps run in the background of other programs and apps.
They are commonly used to circumvent geo-blocked websites, such as overseas Netflix libraries, or region-restricted sites streaming sporting events.
More generally they are used to maintain privacy and security, for instance by professional employees attempting to access emails or an office network from home.
A 2015 poll of more than 1000 people by Essential Research found that 16 per cent had used a VPN or the anonymising Tor network to protect their privacy online.
"Ideally, when these apps run smoothly, they would offer you end-to-end encryption of the traffic from your device to whatever server has been set as the VPN. Think of it as a tunnel hiding all your traffic from any external observation, " Dr Kaafar said.
"But 18 to 20 per cent of these apps are not encrypting traffic at all, they are not offering anything, [only] a false sense of security."
Dr Kaafar also said it was concerning to see how many apps requested permissions for programs they did not need or use, such as SMS messages, call logs, contacts, history and bookmarks, accounts and location.
The research paper ranked 10 apps according to their maliciousness:
- OKVpn
- EasyVpn
- SuperVpn
- Betternet
- CrossVpn
- Archie VPN
- HatVPN
- sFly Network Booster
- One Click VPN
- Fast Secure Payment
Dr Kaafar said around 80 per cent of the apps assessed had some form of leak, meaning that any external observer could see what website a user was accessing, despite encryption.
"Another very alarming find was the presence of malware in some of these apps. Thirty-eight per cent showed some form of malware or malvertising...which is a very serious issue," he said.
"Some of these apps have been installed by more than 50 million people...cumulatively we are talking hundreds of millions of people [who use these apps]."
All the apps that presented concerning results were contacted by the research team in the period between May and June last year. It is understood some of the apps have made changes to update and remove malware and other issues.
"We contacted all the app developers and shared with them all the findings and we had a variety of reactions and feedback," Dr Kaafar said.
"Most developers acknowledged the problems and took actions to fix them...but unfortunately several others acknowledged they were [allowing] these actions to monetise the apps."
As part of the study, the team also analysed user reviews and ratings for VPN apps, finding that less than one per cent of negative app reviews actually rated privacy and security.
A Google spokesperson said it took security "extremely seriously" and vetted all apps to ensure they were compliant with Play policies.