Popular iOS SDK Steals Click Revenue From Other Ad Networks – Expert Insight

Researchers have uncovered malicious code in a popular Advertising SDK used by over 1,200 apps in the AppStore which represent over 300 Million downloads per month. It was uncovered in the iOS versions of the SDK from the Chinese mobile ad platform provider, Mintegral dating back to July 2019  and can spy on user activity by logging URL-based requests made through the app.

Experts Comments

August 25, 2020
Ameet Naik
Security Evangelist
PerimeterX
Open source libraries and third-party SDKs are an inevitable reality for modern web and mobile applications. This Shadow Code—introduced without proper approvals or security validation—vastly expands the attack surface for any organization. While SDKs such as Mintegral can significantly cut down on development time and costs, they include hidden behaviors and with unexpected consequences. Along with ad fraud, this also exposes businesses to potential client-side data breaches, running afoul .....Read More
Open source libraries and third-party SDKs are an inevitable reality for modern web and mobile applications. This Shadow Code—introduced without proper approvals or security validation—vastly expands the attack surface for any organization. While SDKs such as Mintegral can significantly cut down on development time and costs, they include hidden behaviors and with unexpected consequences. Along with ad fraud, this also exposes businesses to potential client-side data breaches, running afoul of data privacy regulation such as CCPA and GDPR. Businesses must take control of Shadow Code in their web and mobile applications by following basic security best practices and by leveraging runtime behavioral analysis to detect and stop hidden code from compromising their user data. Consumers must continue to be vigilant about their personal data and monitor their credit reports for signs of fraudulent activity.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.