Thursday, December 7, 2023

Facebook Owned Onavo VPN Collects User Data Even it is Turned Off

Facebook launched a free VPN program Onavo Protect for Android and iPhone to boost the user privacy and to keep the information secure. But as promised it does not anonymize, instead, it drains your privacy.

Even when the Onavo VPN is turned off it keeps on sending daily Wi-Fi data usage, Mobile data usage, and frames to indicate how long the VPN is connected.

It was criticized starting this month due to its promotional activities and it was first reported by Techcrunch, infosec researcher Will Strafach published a blog post tracking the types of data collected by Onavo Protect.

Onavo Protect contains a Packet Tunnel Provider app extension that performs the additional functions along with the VPN.

Also Read Is it possible to Read Someone Facebook Messages Without Them Knowing?

What are the Data’s Collected – Onavo Protect

Onavo Protect sends Mobile network name, Mobile network code, Mobile country code, Locale/language, iOS version, and Onavo app version.

Onavo tracks when the mobile device screen is on/off, likely only while connected to Onavo Protect.

Tracks daily data usage on Wi-Fi and mobile data using system APIs

DNS request to measure the latency.

Onavo performs timing measurements of Packet Tunnel Provider performance.

Onavo Protect

Facebook response to 9to5mac “When people download Onavo Protect to help secure their connection, we are clear about the information we collect and how it is used. Like other VPNs, Protect acts as a secure connection including when people are on public Wi-Fi.”

This helps us improve and operate the Onavo service. Because we’re part of Facebook, we also use this information to improve Facebook products and services.

We let people know about this activity and other ways that Onavo uses, analyses, and shares data before they download it. We also regularly review our apps and make updates based on feedback from people.


Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles