Security researchers take a look at Google's VPN by Google One app
Google asked security researchers at NCC Group to conduct a security assessment of its new VPN by Google One, and the results have now been published.
Security assessments like these can serve as a useful tool for understanding the relative security of the many different VPN services on the market.
Security
The Google One VPN apps for Android and iOS and its new Windows and macOS VPN apps stood up well to a security source code review by NCC Group, but the firm did find 24 issues of varying degrees of importance, some of which have now been fixed.
Also: The best VPNs for small and home-based businesses
Among the 24 issues found, the most notable was that the Windows Google One VPN app was required to execute with admin privileges: Google has addressed this so that it is executed with user privileges.
Google's VPN doesn't let users select an IP address from different regions to bypass geo-blocking. It does, however, aim to protect a user's internet traffic from ISPs when using a public hotspot. It masks a user's IP address by routing it through a Google-operated VPN tunnel. Last month, Google launched the Google One VPN apps for macOS and Windows. The VPN service is available as part of the $10-a-month plan with 2TB of online storage.
NCC Group assessed the Google One VPN apps and service in the context of the security and privacy goals detailed in Google's whitepaper, such as: "With VPN by Google One, we will never use the VPN connection to track, log, or sell your online activity"; and "A Google-grade VPN that provides additional security and privacy to online connectivity without undue performance sacrifices."
NCC Group also reviewed the security design and architecture of the product and the VPN library's code.
The company concluded that the design of Google's VPN service allows it to "implement user authentication and authorization for the service in a way that isolates the user's Google identity from the VPN session network flows." It added: "The use of cryptographic blind signing during authorization is the traffic anonymization strategy, protecting user's identity from direct association with the VPN session token."
However, NCC Group – which treated Google as a potential adversary in a privileged position in its analysis – did identify "several techniques that could be employed to compromise user anonymity should Google choose or be compelled to actively violate its claims".
Google could, for example, manipulate the client apps to modify the authentication and authorization flow. Google could also correlate a device's source IP and connection times to establish a connection between identity and tunneled VPN traffic. However, it noted that it didn't observe any of the techniques to be part of the product's strategy or implementation.
Also: What are the best mobile VPNs, and do they slow down your connection?
NCC Group also found two medium-risk problems with the login process for the Windows and macOS apps, which could allow local malware to deny availability or obtain an OAuth token after a successful login.
A minor blemish on the iOS app was that Google disabled Apple's App Transport Security feature for enforcing secure connections on the internet. Google also fixed an issue in the iOS app where the app's storage leaks the GAIA ID in log files.
Also, the Android, Windows, and macOS apps lacked certificate pinning, which restricts an app's secure connection to particular certificates. NCC considers it worthwhile to implement certificate pinning to mitigate the risk of interception if the Certificate Authority is compromised.
NCC Group reviewed the Google One Android VPN app last year and found one high-severity flaw, four medium-severity flaws, and six low-severity flaws.