Popular iOS SDK Steals Click Revenue From Other Ad Networks – Expert Insight

Researchers have uncovered malicious code in a popular Advertising SDK used by over 1,200 apps in the AppStore which represent over 300 Million downloads per month. It was uncovered in the iOS versions of the SDK from the Chinese mobile ad platform provider, Mintegral dating back to July 2019  and can spy on user activity by logging URL-based requests made through the app.

Subscribe
Notify of
guest
1 Expert Comment
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
Ameet Naik
Ameet Naik , Security Evangelist
InfoSec Expert
August 25, 2020 10:47 am

Open source libraries and third-party SDKs are an inevitable reality for modern web and mobile applications. This Shadow Code—introduced without proper approvals or security validation—vastly expands the attack surface for any organization. While SDKs such as Mintegral can significantly cut down on development time and costs, they include hidden behaviors and with unexpected consequences. Along with ad fraud, this also exposes businesses to potential client-side data breaches, running afoul of data privacy regulation such as CCPA and GDPR.

Businesses must take control of Shadow Code in their web and mobile applications by following basic security best practices and by leveraging runtime behavioral analysis to detect and stop hidden code from compromising their user data. Consumers must continue to be vigilant about their personal data and monitor their credit reports for signs of fraudulent activity.

Last edited 2 years ago by Ameet Naik
1
0
Would love your thoughts, please comment.x
()
x