What the research on free Android VPN apps found
In 2016, researchers from CSIRO's Data61 (Australia) and UC Berkeley's ICSI published the most-cited analysis of free Android VPN apps: 283 apps from Google Play, all requesting the system VPN permission, presented at ACM IMC 2016. They combined static code analysis, dynamic traffic analysis, and cross-checking against VirusTotal. The word 'VPN' in an app's name guaranteed neither encryption nor anonymity.
of the apps analyzed leaked real user traffic via IPv6 leaks (Ikram et al., CSIRO Data61 / ICSI Berkeley, ACM IMC 2016)
of the free VPN apps analyzed never encrypted user traffic at any point (same study, ACM IMC 2016)
Android's VPN permission (the VpnService class) forces nothing: it just tells the OS that an app will receive a copy of all network packets before they leave the device. Some apps acted as a local proxy that decrypts, reads, and re-encrypts HTTPS traffic to inject their own ads — a pattern technically indistinguishable from a classic man-in-the-middle attack. Corporate session cookies and auth tokens pass through that same midpoint, with nothing stopping them from being logged or forwarded elsewhere.
Why Android's VPN permission is all-or-nothing
Android offers no built-in way to grant the VPN permission 'for these apps only': once accepted, the virtual interface captures traffic from the entire device, including any corporate app on the same phone. In an unmanaged BYOD scenario, an employee installing a free VPN to unblock streaming content is unknowingly routing corporate email or CRM sessions through that same blind spot too.
Why this matters more on a BYOD device
The uncomfortable truth: neither banning BYOD nor forcing a corporate VPN fixes this alone
Requiring a full MDM profile on a personal phone, or banning BYOD outright, runs into legitimate legal and employee pushback, and raises the cost of issuing corporate hardware to the whole workforce. Blurtek's recommendation isn't the maximal fix but the proportional one: separate device management from corporate app management via MAM.
What your company should require in its BYOD policy
- Explicitly ban unaudited third-party free VPN apps on any device with corporate access.
- Adopt Mobile Application Management (MAM) instead of full MDM when the device is personal.
- Enforce app-level conditional authentication, not just network-level.
- Shorten session token lifetimes on critical corporate applications.
- Train staff on one verifiable fact: Android's VPN permission grants access to all phone traffic, not just the requesting app's.
Does your company allow BYOD without ever reviewing what network apps employees install on their own phones? Blurtek audits the real corporate access perimeter, personal devices included, and designs a proportional BYOD policy.
Solicitar diagnóstico