A Review of Virtual Private Network Mobile Application Security

Abstract

In an era of heightened online risks, the demand for Virtual Private Networks (VPNs) has surged. The VPN market has grown significantly, ranging from popular services like NordVPN, which holds a quarter of the market share, to applications with a small installation base. Studies show that as of 2024, 46% of Americans use at least one VPN application. Given VPNs' role in protecting sensitive data, questions have arisen regarding the security posture of VPN applications themselves. This study systematically reviewed 27 Android VPN applications selected from mobile app stores, following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines to ensure methodological transparency and reproducibility. The analysis utilized application software review, the Mobile Security Framework (MobSF), and public-facing information to assess each application's vulnerabilities, required permissions, and data collection practices. The findings revealed significant variability across the applications and common issues, such as the use of insecure random number generators, excessive permission requests, exported components lacking proper access controls, and the logging of sensitive user information. Based on these results, the study highlights the need for improved secure coding practices to enhance the security posture of existing mobile VPN applications.