There are at least 20 ad-blocking and VPN apps owned by Sensor Tower who could have secretly spied on the smartphone activities of the almost 35 million users who downloaded them: what emerges from an investigation conducted by BuzzFeed and made known on Monday.
Sensor Tower, a market intelligence firm as it describes itself, owns over 20 apps for Android and iOS which are proposed as ad-blocker and VPN solutions, the latter obviously with the aim of protecting users from prying eyes by redirecting traffic to and from a device through an encrypted tunnel.
Once installed and activated, however, these apps have access to device traffic, making this information available to the Sensor Tower itself. This is possible because the apps ask the user to install a root certificate by going from an external website to the Play Store and App Store, thus dodging the restrictions. Apps do not make explicit their connection with Sensor Tower or the fact that they are passing on information. Four of these apps have recently been available on the Play Store under the name Free and Unlimited VPN, Mobile Data, Luna VPN and Adblock Focus; the latter two also appeared on the App Store.
All in all all 20 Sensor Tower apps have been downloaded 35 million times. Most have already been removed from stores due to violation of rules or reported to Google and Apple. Some other apps are under analysis instead.
Randy Nelson, head of mobile insights for Sensor Tower, told BuzzFeed: "We take app store guidelines very seriously and make concerted efforts to adhere to them, along with any changes that may occur to these rules from time to time." Nelson added that Sensor Tower apps do not collect personally identifiable information or sensitive data such as passwords and usernames.
Tracing the user's activities is in fact a basic component of the so-called app economy, and hiding this kind of fictions in apps designed specifically to want to safeguard the user a well-tested tactic. There are already many precedents, one of the most prominent that of Onavo Project with which Facebook has collected the information of users who have joined it, also in this case by offering a VPN service.
Realities that collect data often shield themselves behind the chimera ofanonymisation, which in reality an extremely fragile paper castle as we had already encountered some time ago: The illusion of anonymity on the web: this is how it neutralizes by crossing the data-leaks. Anonymized data can often be traced back to the person to whom it belongs, and this perspective becomes extremely problematic when they leave the marketing ecosystem to end up in unknown hands and with bad intentions.
As always, the advice is to pay great attention to anything you want to install on your phone, especially when dealing with applications that by their nature are to manage the traffic of our device.