Several Hong Kong-Based VPN Apps Exposed Their Private User Data Online

  • Seven Hong Kong-based VPN products have been proven to be recording massive amounts of user data.
  • The products have been storing this data on an unprotected Elasticsearch instance in a common server.
  • The data is very revealing, including names, emails, passwords, IP addresses, home addresses, and more.

A group of seven VPN products that are supposedly “no-log” services has exposed 20 million users by leaving a server unprotected online. All seven of the products come from the same Hong Kong-based developer, Dreamfii HK Limited, which is the reason why they were using the same Elasticsearch server.

The exposed VPNs are UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN. The number of files that were online exceeded a billion and the total data size was about 1.2 TB.

https://twitter.com/MayhemDayOne/status/1283413586279366661

The compromised user data includes the following:

  • Internet activity logs
  • Names
  • Email addresses
  • Passwords in plain text form
  • IP addresses
  • Home addresses
  • Smartphone device models and IDs

ufo-vpn-exposure
Source: Comparitech Blog

For “no-log” VPNs, this is way too much data to be collected, so these products’ marketing promises are straight out false. The exposed users are now running the risk of getting scammed, extorted, phished, or even arrested and prosecuted if they accessed websites that are banned in their home countries.

These apps enjoyed very good user rating scores on the Apple App Store and the Google Play Store, so they were trusted by millions of people. The fact that they’re free, though, should be enough for the users to expect issues when it comes to these products’ privacy and security.

Both Ran Locar and Bob Diachenko, who independently located the unsecured instance, have informed the owners of the VPN services about the security issue, but they were unresponsive. The date of discovery and notification is July 5, 2020, and the live server was not closed until ten whole days had passed. This is indicative of a VPN company that doesn’t care and comes as a topping on the cake of insecurity and bad practices followed across the board.

These VPN products will lose some users due to this incident, but the news won’t reach everyone, and free products are always a good lure for new users in the future.

As we have explained before, the only way to be certain about the validity of a VPN product’s “no logs” policy is to trust audits carried out by independent firms. For example, NordVPN has recently passed an audit of this kind, and PureVPN did the same last year. These are trustworthy products not because they make reassuring claims on their respective websites, but because they paid an auditing firm to thoroughly investigate their claims and confirm them as truthful.

Read More:

REVIEW OVERVIEW

Recent Articles

How to Watch Taylor Swift’s Folklore: The Long Pond Studio Session

Taylor Swift's Folklore album broke all sorts of records this year, and we're now getting an intimate concert of it all! In...

Everything That’s Coming to Amazon Prime in December 2020

Amazon Plus is preparing a bunch of cool movies and shows for the length of December. We're quite eager to see what...

12 Best VPN Black Friday & Cyber Monday Deals 2020 (LIVE NOW)

As you've surely noticed, Black Friday and Cyber Monday are no longer one-day shopping events. Instead, you'll see many deals spanning across...