Google Play Store Allows Clone VPNs to Circumvent Security Checks

The Google Play Store's automated submission checks have been found to be vulnerable to exploitation by clone VPN apps. These apps, which have been downloaded tens of millions of times, have been able to bypass developer website requirements by maintaining non-existent or dummy website links.

Our audit identified 14 separate Android VPN apps with over 10 million downloads each that maintain non-existent, broken, or dummy website links. Some of these apps redirect users to blank pages, active server errors, or HTTP '403 forbidden' errors.

Experts warn that these apps may lack dedicated corporate infrastructure, 24/7 support channels, and transparent legal documentation, compromising user security. This raises concerns about the security and legitimacy of these apps.

Google has not commented on the issue, but experts urge users to be cautious when downloading VPN apps from the Google Play Store. Users should carefully review app descriptions and check for reviews and ratings before downloading.

The Google Play Store's automated submission checks are designed to ensure that apps meet certain requirements before they are made available for download. However, it appears that these checks have been exploited by clone VPN apps, allowing them to bypass these requirements.

The issue highlights the need for more robust security measures to be put in place to prevent the exploitation of the Google Play Store's automated submission checks. Until then, users should be cautious when downloading VPN apps from the Google Play Store.