A popular iOS software development kit (SDK) used by over 1,200 apps—with a total of more than a billion mobile users—is said to contain malicious code with the goal of perpetrating mobile ad-click fraud and capturing sensitive information.
According to a report published by cybersecurity firm Snyk, Mintegral — a mobile programmatic advertising platform owned by Chinese mobile ad tech company Mobvista — includes an SDK component that allows it to collect URLs, device identifiers, IP Address, operating system version, and other user sensitive data from compromised apps to a remote logging server.
The malicious iOS SDK has been named “SourMint” by Snyk researchers.
“The malicious code can spy on user activity by logging URL-based requests made through the app,” Snyk’s Alyssa Miller said in a Monday analysis. “This activity is logged to a third-party server and could potentially include personally identifiable information (PII) and other sensitive information.”
“Furthermore, the SDK fraudulently reports user clicks on ads, stealing potential revenue from competing ad networks and, in some cases, the developer/publisher of the application,” Miller added.
Although the names…
http://feedproxy.google.com/~r/TheHackersNews/~3/OFzHBb3x0A8/ios-sdk-ad-fraud.html