Several Hong Kong-Based VPN Apps Exposed Their Private User Data Online

  • Seven Hong Kong-based VPN products have been proven to be recording massive amounts of user data.
  • The products have been storing this data on an unprotected Elasticsearch instance in a common server.
  • The data is very revealing, including names, emails, passwords, IP addresses, home addresses, and more.

A group of seven VPN products that are supposedly “no-log” services has exposed 20 million users by leaving a server unprotected online. All seven of the products come from the same Hong Kong-based developer, Dreamfii HK Limited, which is the reason why they were using the same Elasticsearch server.

The exposed VPNs are UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN. The number of files that were online exceeded a billion and the total data size was about 1.2 TB.

The compromised user data includes the following:

  • Internet activity logs
  • Names
  • Email addresses
  • Passwords in plain text form
  • IP addresses
  • Home addresses
  • Smartphone device models and IDs

ufo-vpn-exposure
Source: Comparitech Blog

For “no-log” VPNs, this is way too much data to be collected, so these products’ marketing promises are straight out false. The exposed users are now running the risk of getting scammed, extorted, phished, or even arrested and prosecuted if they accessed websites that are banned in their home countries.

These apps enjoyed very good user rating scores on the Apple App Store and the Google Play Store, so they were trusted by millions of people. The fact that they’re free, though, should be enough for the users to expect issues when it comes to these products’ privacy and security.

Both Ran Locar and Bob Diachenko, who independently located the unsecured instance, have informed the owners of the VPN services about the security issue, but they were unresponsive. The date of discovery and notification is July 5, 2020, and the live server was not closed until ten whole days had passed. This is indicative of a VPN company that doesn’t care and comes as a topping on the cake of insecurity and bad practices followed across the board.

These VPN products will lose some users due to this incident, but the news won’t reach everyone, and free products are always a good lure for new users in the future.

As we have explained before, the only way to be certain about the validity of a VPN product’s “no logs” policy is to trust audits carried out by independent firms. For example, NordVPN has recently passed an audit of this kind, and PureVPN did the same last year. These are trustworthy products not because they make reassuring claims on their respective websites, but because they paid an auditing firm to thoroughly investigate their claims and confirm them as truthful.

Read More:

REVIEW OVERVIEW

Recent Articles

How to Hide VPN IP Addresses (4 Options That Work)

There are tons of online guides that talk about how you can hide your IP address (here's our own). But we have yet to...

How to Watch ‘Black Clover’ Season 1 – 3 (Dub & Sub) Online

When it comes to manga and anime, everyone has favorites. Well, Black Clover is the favorite of many of our team members, and we're...

Browser Fingerprinting and You (What It Is, How It Works, How It Violates Your Privacy, and What You Can Do)

Many people use VPNs to protect their privacy by hiding their IP address. Websites, hackers, advertisers, and ISPs can't track your geo-location and digital...