Great writeup! > I have to give props for Swing VPN teams creativity to bypass security measure of Apple appstore and Google PlayStore but it is sad that Apple

Great writeup! > I have to give props for Swing VPN teams creativity to bypass security measure of Apple appstore and Google PlayStore but it is sad that Apple/Google security systems does not have some automated ways to detect these types of actions. It's a tricky problem. The amount of attack traffic from an infected device is negligible and very little of it is visible to the operating system due to TLS. It's also presumably intermittent (there's no point in keeping an attack ongoing forever; you stop when the site has found a way to defend itself), so just running the app for a while as part of validating an update might not show any suspicious behavior. The suspicious part is in the configurations downloaded from the CnC servers, not packaged with the app, so static analysis won't help. The only reliable option for catching these proactively thatI can think of would be to use some kind of aggregate telemetry from all the app installations combined, but that'd be incredibly scary both in terms of privacy and the blast radius when something goes wrong. > Currently in the beginning of June 2023 it has over 5 million install base on android That's not really a reliable number. It's more like "the number of distinct users who had this app installed at some point". AFAIK it doesn't get decremented when somebody uninstalls the app, and doesn't go up when somebody installs it for a second time on a new device. Those factors might cancel out, might not.