Fleeceware masquerading as VPNs is sitting on the Apple App Store says security vendor, Avast. It claims the apps overcharge users and do not provide the services they promote. Avast has named the three apps as Buckler VPN, Hat VPN Pro and Beetle VPN. It has reported the products to Apple, although as of writing, all three are still available in the Apple App Store.
All three apps appear to have been downloaded thousands of times between April 2019 and May 2020. Avast cites download numbers from Sensor Tower, a mobile apps marketing intelligence and insights company. It records the downloads of each app as Beetle VPN – 420k, Buckler VPN – 271k and Hat VPN Pro – 96k. What these numbers don’t show is how many people paid for the apps rather than just downloaded them.
Nikolaos Chrysaidos, Head of Mobile Threats & Security at Avast said: “Fleeceware apps fall into a grey area because they are not malicious per se, they simply charge users absurd amounts of money for weekly, monthly or yearly subscriptions for features that should be offered at much lower costs. In this case, the VPNs are being sold for $9.99 (USD) a week, when trustworthy VPNs cost ten times less.
“These apps are not behaving maliciously, so they circumvent screening processes to be added to the official app stores’ that users trust. With many people turning to VPN apps to protect their data while working remotely, this illustrates how important it is for users to research VPN apps before installing them, including who is behind the product, their track record with other products and user reviews, and experience in offering security and privacy apps.”
Why has Avast labelled the apps Fleeceware?
Avast has labelled the apps fleeceware because they overcharge users and do not provide the services they promote. It downloaded and tested all three apps and says: “Avast researchers installed the three apps and successfully purchased subscriptions to each app; however, when they tried to use the VPNs, the apps only provided subscription options again. After attempting to purchase the subscriptions again, Avast researchers were notified they already have a subscription and thus were unable to establish a VPN connection using any of the apps.”
Avast calls out other things that indicate users should be wary. It points out that many of the reviews on the site are similarly written. Interestingly, some reviews warn of the overcharging, but these are few and far between. It also highlights the privacy policies used by the apps saying that they, too, have very similar structure and language.
Avast’s tips on how to recognize fleeceware apps
Fleeceware apps can come in any category. The reviews for fleeceware apps tend to look fake, with multiple users leaving a review like “Exciting” or “My love”, and real reviews reveal the app does not actually work, or unknowingly charges users large sums of money.
Fleeceware apps typically offer a free three to seven-day trial but can require users to enter their payment information before the trial begins, and automatically charge users unreasonable sums of money after the trial ends.
Users should carefully note what happens after an app’s trial period ends and how much an app will charge after a free trial period. They should also check if the charge will be automatically deducted from their card on an ongoing basis unless they cancel the subscription.
Enterprise Times: What does this mean
All App Stores have problems with fake and malicious apps. While Apple has done a far better job than Google, it is not perfect. The problem with fleeceware is that it passes all the tests required to get on the platform. As long as it delivers revenue to the App Store platform, it is seen as being good.
It will be interesting to see if Apple now takes these apps off of its App Store or if the owners, somehow, fix them.
The apps also present a concern to IT security teams. If they don’t work as a VPN, could they be doing something else? For now, anyone who has downloaded the apps should follow Avast’s advice and contact their credit card provider to stop payment and request a refund.