VPNalyzer: Crowdsourced Investigation into Commercial VPNs

VPNalyzer is an interdisciplinary research project from the University of Michigan that aims to analyze the VPN ecosystem

Pioneering research into investigating commercial VPN services

Three parallel tracks:

• Quantitative and qualitative user studies
• Cross-platform one-click install desktop tool for users
• Qualitative studies surveying VPN providers

Our testing methodology and the VPNalyzer tool was used by Consumer Reports as the first line of systematic investigation to evaluate a set of popular VPNs. Our work was featured in their white paper detailing their objective evaluation of popular VPNs.

The white paper outlines how they used VPNalyzer and their own testing to arrive at three top VPNs. Our work and insights were quoted in the following articles written by Consumer Reports: Should You Use a VPN? and VPN Testing Reveals Poor Privacy and Security Practices, Hyperbolic Claims.

Our tool consists of a measurement test suite that contains 15 measurements including tests for aspects of service, security and privacy essentials, misconfigurations, and leakages.

With our limited release in early 2021, VPNalyzer found several notable issues in VPN products. We found DNS and IPv6 leaks whereby users' queries and traffic were leaked to their Internet service providers (ISP) which poses security and privacy risks for the users. We found a VPN product with insecure default configurations that only tunnelled browser traffic by default and caused traffic from other apps on the user's machine to be exposed to their ISP. We also discovered that many VPN providers in their default configurations allowed the users' traffic to be leaked to their ISP and did not protect them in case of tunnel failure. The feature that mitigates this leak is commonly known as the kill switch feature, which we discovered is not enabled by default in these providers.

If you are interested in testing a future release of our tool, please fill this form to join our mailing list.

We are a group of computer science researchers at the University of Michigan who design and deploy scalable techniques and systems to protect users' Internet experience.

We conduct systematic, data-driven studies to investigate security, and privacy issues in the VPN ecosystem and aim to bridge the gap between its various stakeholders.

VPNalyzer includes the Npcap Windows packet sniffing (and sending) library with permission from The Nmap Project.

We run StatCounter on this webpage to collect statistics about the number of users of our tool and our website to supply reports to grant agencies. We do not use this data for any other purposes. We also have configured StatCounter to anonymize the last octet of each visitor's IP address i.e. if your IP is 198.51.100.68, StatCounter only shows us 198.51.100.??.