Skip to main content

Analysis of Facebook ‘Protect’ VPN code raises more questions

Updated with Facebook comment at the end

Facebook caused a lot of raised eyebrows when it incorporated the Onavo Protect iOS VPN app into its own app in a feature it called Protect.

Facebook billed it as protecting user data, but in practice it does the opposite, allowing Facebook to collect and analyze your data. A new analysis of the Onavo Protect code by security researcher Will Strafach raises more questions …

Strafach found that the app is collecting data even when the VPN is switched off.

I found that Onavo Protect uses a Packet Tunnel Provider app extension, which should consistently run for as long as the VPN is connected, in order to periodically send the following data to Facebook (graph.facebook.com) as the user goes about their day:

  • When user’s mobile device screen is turned on and turned off
  • Total daily Wi-Fi data usage in bytes (Even when VPN is turned off)
  • Total daily cellular data usage in bytes (Even when VPN is turned off)
  • Periodic beacon containing an “uptime” to indicate how long the VPN has been connected

Data collected includes cellular carrier name, mobile network code, mobile country code, locale/language and iOS version.

Normally, if you want to find out what data an app is transmitting back to a server, you create a proxy to intercept the traffic – but Strafach notes that is difficult in this case.

Due to the nature of conducting analytics data uploads while the Packet Tunnel Provider is running, it is likely that data uploads will mostly occur inside the Onavo VPN tunnel.

In other words, the data being sent to Facebook is encrypted.

Strafach says his analysis raises a number of questions, including how it uses some of the data (like when your screen is on or off) and whether the data collected is in any way associated with the user’s Facebook account?

As always, our advice is to be wary of any free VPN: these generally make their money by selling the data. The safest course is to opt for a VPN that keeps no user logs.

Update: Facebook told us:

When people download Onavo Protect to help secure their connection, we are clear about the information we collect and how it is used. Like other VPNs, Protect acts as a secure connection including when people are on public Wi-Fi. As part of this process, Onavo receives their mobile data traffic. This helps us improve and operate the Onavo service. Because we’re part of Facebook, we also use this information to improve Facebook products and services. We let people know about this activity and other ways that Onavo uses, analyses, and shares data before they download it. We also regularly review our apps and make updates based on feedback from people.

Photo: Dado Ruvic/Reuters


Check out 9to5Mac on YouTube for more Apple news:

FTC: We use income earning auto affiliate links. More.

You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

Comments

Author

Avatar for Ben Lovejoy Ben Lovejoy

Ben Lovejoy is a British technology writer and EU Editor for 9to5Mac. He’s known for his op-eds and diary pieces, exploring his experience of Apple products over time, for a more rounded review. He also writes fiction, with two technothriller novels, a couple of SF shorts and a rom-com!


Ben Lovejoy's favorite gear