At Least 1,200 iOS Apps Constitute a Privacy Risk for Users

• A malicious SDK from a company in Guangzhou, China, is engaging in ad fraud and malicious user data access.
• The software was tuned to operate cleverly in order not to raise flags and be detected by researchers.
• Apple knows about it now, but informing hundreds of app developers to change their SDKs will be tricky.

According to details that have surfaced, a large China-based ad network named ‘Mintegral’ is linked with ad fraud, privacy-breaching practices, and basically malware. As it also happens, Mintegral’s SDK is used by approximately 1,200 apps currently available on the Apple App Store, which account for a total of 300 million installations since the beginning of this month alone.

A notable example is “Helix Jump,” an action game that has 500 million downloads. Other popular apps using the particular SDK are “Talking Tom,” “PicsArt,” “Subway Surfers,” and “Gardenscapes.”

This discovery comes from researchers at Snyk, who identified a malicious component in the Mintegral SDK, which they found to be an ad clicker. This means that users having the infected apps installed on their devices are loading ads in the background, which are then getting clicked by a bot that simulates user actions, and this makes a profit for Mintegral from referrals.

In addition, the SDK injects code in standard iOS functions within the application, which grants it access to private user information that the user never consented to share. So, essentially, this SDK turns the games into stealthy spyware.

The things that the SDK can collect and log are the following:

• OS Version
• IP Address
• charging state
• Mintegral SDK Version
• network type
• model
• package name
• IDFA
• URL
• request headers
• method name
• class Name
• backtrace data

For this reason, Snyk informed Apple about their findings last week, and they expect the company to contact all affected iOS app developers as the list is pretty extensive. To clarify, the app developers don’t know about the fraudulent nature of the Mintegral SDK, so they are not willingly supporting it, and neither are they responsible for the data it collects.

Apple is already working on the introduction of privacy-related safeguards in the upcoming iOS 14, so hopefully, SDKs like Mintegral’s won’t be left to fly under the radar for much longer now.

To avoid detection thus far, the malicious SDK checks if it runs inside an OS simulator and stops. If the device is rooted or proxying, it stays inactive. When the app is turned on, it keeps conversion rates between 20% and 30% instead of pushing the throttle to 100%. This helps keep the risk of detection at a minimum. Now that Snyk published the details, Mintegral will most likely change its name and return with a more careful approach.

[UPDATE]: Mintegral has contacted TechNadu to share the following statement, which denies the allegations made by Snyk: