iOS ad developer kit reportedly steals click revenue, harvests user data

guest · Aug 25, 2020

iOS ad developer kit reportedly steals click revenue, harvests user data
August 24, 2020
https://appleinsider.com/articles/2...tedly-steals-click-revenue-harvests-user-data

Malicious code that steals ad click revenue within apps has been discovered in a popular iOS software development kit.

The code was found hidden in the SDK of Chinese advertising platform Mintegral, according to a report by cybersecurity firm Snyk which notes the SDK is used by more than 1,200 apps that are downloaded a combined 300 million times a month.
Like other advertising-related SDKs, the Mintegral kit allows developers to embed ads within their apps without much effort or additional coding. Mintegral provides the SDK to developers for free on both iOS and Android.
Click to expand...

Essentially, the malicious portion of the SDK — dubbed "SourMint" — is stealing app revenue from other ad networks. Many apps use multiple ad SDKs to diversify their monetization strategies.

In an email to ZDNet, Apple said that it has spoken to the Snyk security researchers and does not see any evidence that the SDK is harming users.
According to Snyk, the "scope of data being collected is greater than would be necessary for legitimate click attribution." All of the user data is also being sent to a remote server.

Mintegral also appears to have portions of code that attempt to hide the nature of the data being collected.
Click to expand...

Snyk didn't release a list of apps that use the Mintegral SDK, and users have no way of knowing which development kits an app maker uses in their platforms. Developers will need to review their own code bases to identify and remove the malicious kit. The malicious portion of the kit was reportedly introduced in version 5.5.1, released in July 17, 2019.
Click to expand...

Snyk:
SourMint: malicious code, ad fraud, and data leak in iOS

The Snyk research team has uncovered malicious behavior in a popular Advertising SDK used by over 1,200 apps in the AppStore which represent over 300 Million downloads per month, based on industry expert estimates.

The malicious code was uncovered in the iOS versions of the SDK from the Chinese mobile ad platform provider, Mintegral dating back to July 2019. The malicious code can spy on user activity by logging URL-based requests made through the app.
Click to expand...

(Research Write Up) SourMint Malicious SDK

guest · Aug 25, 2020

Apple Disagrees With Report About Mintegral Ad SDK
August 25, 2020
https://www.inforisktoday.com/apple-disagrees-report-about-mintegral-ad-sdk-a-14882

Security company Snyk alleges that an advertising software development kit embedded in 1,200 iOS apps is misattributing ad clicks to steal revenue and logging potentially sensitive user actions.

"Many popular applications were affected by the malicious activities of this SDK," writes Alyssa Miller, application security advocate with Snyk, in a blog post. "We hope this research shedding light on the situation will drive greater scrutiny and privacy controls for advertiser networks moving forward."
But Apple tells Information Security Media Group that there's no evidence to suggest apps with the SDK are harming users. Apple says the research does show, however, that app developers should be careful in how they integrate third-party code into apps because it could have impacts on privacy and security.

So far, it doesn't appear Apple has taken any action to have developers remove the SDK from their apps.
Click to expand...

The evasive behaviors may explain why Mintegral passed "through Apple's app review process without being detected," Snyk says.

The demo video purportedly shows how Mintegral logs data that could be sensitive. The QR scanner is used to scan a code that leads to a URL with a Google document labeled "Top Secret." In the background, Mintegral reaches out to the URL "n[dot]systemlog[dot]me" and sends an encoded payload. The encoded payload turns out to be a URL for the Google document.

"The malicious Mintegral SDK is monitoring every single HTTP request our mobile application makes and sending back potentially sensitive data about both the application and the user."
Click to expand...

Log in or Sign up

iOS ad developer kit reportedly steals click revenue, harvests user data

guest Guest

guest Guest

Log in or Sign up

iOS ad developer kit reportedly steals click revenue, harvests user data

guest Guest

guest Guest

Useful Searches