SuperVPN’s critical vulnerability affecting 100 million users However, users with SuperVPN installed are currently still susceptible and should delete the app immediately. Unfortunately, this proved impossible, and on April 7, Google removed the SuperVPN app from Google Play. We worked with Google to contact SuperSoftTech so that they could address the issue and hopefully patch it. On March 19, the Google team confirmed to us that the vulnerability was still present in the latest version of Super VPN: GPSRP allows security analysts to disclose vulnerabilities for apps with more than 100 million installs. We disclosed the finding through the Google Play Security Reward Program (GPSRP) because we have been unable to contact SuperVPN’s developer, SuperSoftTech. Recently, Google confirmed to us that this vulnerability still exists. Our research has shown that it has critical vulnerabilities that allow for man-in-the-middle (MITM) attacks that can easily allow hackers to intercept communications between the user and the provider, and even redirect users to a hacker’s malicious server instead of the real VPN server. Unfortunately, it’s also an amazingly dangerous free VPN Android app. It has more than 100 million installs on the Play store, having started from only 10,000 installs nearly four years ago. SuperVPN Free VPN Client is an amazingly successful free VPN Android app. On April 7, it was finally removed from the Google Play store. Google has confirmed that SuperVPN, which has 100 million installs, has a vulnerability that allows for a critical MITM attack.

Supervpn