Collaborative Research: SaTC: CORE: Medium: Uncovering and Mitigating Security and Privacy Threats in the Mobile VPN Ecosystem

Virtual Private Networks (VPNs) are one of the most fundamental security and privacy tools that have found their way into regular Internet users' toolboxes. Despite widespread reliance on these tools, the mobile VPN ecosystem is rife with VPNs, posing several privacy and security issues. There is no visibility into the extent of the problems in mobile VPN apps beyond a few isolated examples based on manual reverse engineering efforts. The project’s novelties are new tools and methods to uncover hidden risks in mobile VPNs, which many people use to stay private online. The project’s broader significance and importance are in bringing together researchers, advocates, and VPN providers to better understand the risks and strengthen the safety and privacy of VPN services for everyone. This effort advances technical solutions needed for assessing and mitigating the risks associated with the mobile VPN ecosystem. The current Reverse engineering tools are less developed for mobile environments, and their effectiveness is further limited by the complexity of the mobile VPN ecosystem. This project facilitates systematic investigation into the mobile VPN ecosystem by understanding current practices and designing and building novel frameworks capable of conducting large-scale analysis. The project also uses this framework to explore and evaluate different components of the mobile VPN ecosystem, such as free VPNs. Finally, the project also focuses on advancing the understanding of detection and interference attacks on mobile VPNs. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.