VPN in question seemingly implicated in suspected theft from Windscribe
In a recent turn of events, Google Play has bolstered its verification process for Virtual Private Network (VPN) apps, following the discovery of a suspicious VPN service, Jet VPN, using stolen servers.
Jet VPN, which initially started as a picture frame app, has seen a string of one-star reviews warning users not to download it. Despite this, the app boasts thousands of five-star reviews and claims to be "100% private and secure." However, a closer look revealed that Jet VPN has no reputation, no social media presence, and an even more basic website, seemingly only two pages.
The discovery of Jet VPN's actions was almost accidental. Security company Windscribe, which previously uncovered similar issues with another VPN, Hizen VPN, noticed something amiss with Jet VPN. Subsequently, Windscribe banned the stolen accounts Jet VPN was using. Interestingly, positive reviews of Jet VPN continued to pour in after Windscribe's discovery, causing it to rise to #5 on Google Play's free apps list.
Windscribe found out that Jet VPN was using its servers, a fact that was later confirmed when Jet VPN switched to leeching off Private Internet Access' servers. However, confirmation from Private Internet Access is still pending. Almost 500 new reviews of Jet VPN were noted by Windscribe in one night.
In response to the incident, Google Play has introduced a VPN badge for independently verified VPN apps to help users identify trusted services. This verification likely includes security vetting improvements to reduce risks such as those exposed by the Jet VPN server theft. The verification process details remain partly undisclosed, but they are consistent with tightened app security controls seen elsewhere in Google Play policies.
The damage and impact to Windscribe appear to be low, but the incident has highlighted the growing issue of suspect free VPNs. These VPNs have spiked in popularity, especially in the UK due to the Online Safety Act.
As Google continues its efforts to increase platform trustworthiness amid rising concerns over app and device security, it's clear that the VPN app verification process is under scrutiny. While no current evidence suggests a complete overhaul or ban on VPN apps, stricter Google Play Integrity checks are probable.
Meanwhile, Jet VPN's user base was reportedly under 100, and the company's developers have denied using Windscribe servers. Despite this, it serves as a reminder for users to be vigilant when choosing a VPN service and to prioritise services with a strong reputation and transparent practices.
Businesses in the technological realm, such as Windscribe and Private Internet Access, are increasingly working to maintain the security of their servers due to an uptick in suspicious activities by VPN services like Jet VPN. This online incident has emphasized the importance of finance-related measures, like thorough vetting and verification processes, in the world of cybersecurity, especially for VPN apps.
