Five VPN apps in the App Store had links to Chinese military

At least five VPN apps in the App Store were found to have links to the Chinese military, according to a new report today. Three of them have racked up more than a million downloads.

A subsidiary of one of the Chinese companies behind the apps is currently hiring for a role in “monitoring and analysing platform data,” with a familiarity with American culture listed as a job requirement …

VPN apps

Virtual Private Network (VPN) apps are designed to protect the privacy of internet usage, protecting against man-in-the-middle attacks using fake public Wi-Fi hotspots, as well as ensuring your ISP or mobile carrier can’t track the websites you visit.

Additionally, VPNs can be used to circumvent geoblocks on anything from streaming video services to content banned by a country’s government.

However, VPNs are only as trustworthy as the companies behind them. A fake VPN can expose all your browsing data to its developer.

Five VPN apps linked to Chinese military

A joint investigation by the Tech Transparency Project and the Financial Times found that at least five VPN apps present in both the App Store and Google Play store had links to a company associated with the Chinese military.

At least five free virtual private networks (VPNs) available through the US tech groups’ app stores have links to Shanghai-listed Qihoo 360, according to a new report by research group Tech Transparency Project, as well as additional findings by the Financial Times.

Qihoo, formally known as 360 Security Technology, was sanctioned by the US in 2020 for alleged Chinese military links. The US Department of Defense later added Qihoo to a list of Chinese military-affiliated companies […]

In recent recruitment listings, Guangzhou Lianchuang says its apps operate in more than 220 countries and that it has 10mn daily users. It is currently hiring for a position whose responsibilities include “monitoring and analysing platform data”. The right candidate will be “well-versed in American culture”, the posting says.

The five apps are:

Turbo VPN
VPN Proxy Master
Thunder VPN
Snap VPN
Signal Secure VPN (not associated with the Signal messaging app)

After the FT alerted Apple, the company removed Thunder VPN and Snap VPN from the App Store. The fate of the three remaining apps is unclear.

The full piece outlines the complex network of individuals and companies the investigators had to unravel in order to reveal the connections.

9to5Mac’s Take

You should only ever use VPN apps offered by reputable companies, ideally those like NordVPN who have permitted independent audits of their security.

Chinese VPN apps are never to be trusted since the law requires developers to keep usage logs and to make these available to the government. Apps which do not comply with this requirement were removed from the App Store way back in 2017.