Researchers have uncovered malicious code in a popular Advertising SDK used by over 1,200 apps in the AppStore which represent over 300 Million downloads per month. It was uncovered in the iOS versions of the SDK from the Chinese mobile ad platform provider, Mintegral dating back to July 2019 and can spy on user activity by logging URL-based requests made through the app.
Open source libraries and third-party SDKs are an inevitable reality for modern web and mobile applications. This Shadow Code—introduced without proper approvals or security validation—vastly expands the attack surface for any organization. While SDKs such as Mintegral can significantly cut down on development time and costs, they include hidden behaviors and with unexpected consequences. Along with ad fraud, this also exposes businesses to potential client-side data breaches, running afoul of data privacy regulation such as CCPA and GDPR.
Businesses must take control of Shadow Code in their web and mobile applications by following basic security best practices and by leveraging runtime behavioral analysis to detect and stop hidden code from compromising their user data. Consumers must continue to be vigilant about their personal data and monitor their credit reports for signs of fraudulent activity.