Sensor Tower Secretly Collecting Data From VPN and Ad-Blocking Apps on iOS and Android

guest · Mar 9, 2020

Sensor Tower Secretly Collecting Data From VPN and Ad-Blocking Apps on iOS and Android
March 9, 2020
https://www.macrumors.com/2020/03/09/sensor-tower-vpn-app-data-collection/

Sensor Tower, an analytics platform that aggregates data on app downloads and usage for developers, has been secretly collecting data from millions of Android and iOS users who have installed popular VPN and ad-blocking apps, reports Buzzfeed News.
iOS and Android users have downloaded the apps more than 35 million times.

Some of Sensor Tower's 20 or more apps on iOS and Android include Adblock Focus and Luna VPN, with the former having been removed by Apple after Buzzfeed News alerted Apple's App Store team about the existence of the app. Free and Unlimited VPN and Mobile Data were also on the Google Play Store, but Google has since removed Mobile Data.

When installed, Sensor Tower's apps are designed to prompt users to install a root certificate, which lets Sensor Tower monitor all traffic and data passing through the phone.
Click to expand...

An Apple spokesperson confirmed that a dozen Sensor Tower apps had previously been removed from the iOS ‌App Store‌ due to violations. Both Google and Apple are continuing to investigate Sensor Tower's apps, and more information on Sensor Tower's data collection practices can be found over at Buzzfeed News.

iOS users should be wary of installing VPN and ad-blocking apps from unknown developers, and should avoid apps that ask for certificates to be installed.
Click to expand...

Buzzfeed News: Popular VPN And Ad-Blocking Apps Are Secretly Harvesting User Data

Once installed, Sensor Tower's apps prompt users to install a root certificate, a small file that lets its issuer access all traffic and data passing through a phone. The company told BuzzFeed News it only collects anonymized usage and analytics data, which is integrated into its products.

Armando Orozco, an Android analyst for Malwarebytes, said giving root privileges to an app exposes a user to significant risk.

“Your typical user is going to go through this and think, Oh, I‘m blocking ads, and not really be aware of how invasive this could be,” he said.
Randy Nelson, Sensor Tower’s head of mobile insights, said the company did not disclose ownership of the apps for competitive reasons.
Click to expand...

Apple and Google restrict root certificate privileges due to the security risk to users. Sensor Tower’s apps bypass the restrictions by prompting users to install a certificate through an external website after an app is downloaded.
Click to expand...

Log in or Sign up

Sensor Tower Secretly Collecting Data From VPN and Ad-Blocking Apps on iOS and Android

guest Guest

Log in or Sign up

Sensor Tower Secretly Collecting Data From VPN and Ad-Blocking Apps on iOS and Android

guest Guest

Useful Searches