This'll upset the Apple cart: 1,200 iOS apps downloaded 300 million times a month include 'ad fraud' code

Synk accuses China-based Mintegral of distributing malicious SDK

Updated For over a year, a widely used code library from Chinese mobile ad biz Mintegral is alleged to have been covertly capturing data about app users' online interactions to steal ad revenue.

According to security biz Snyk, the Mintegral SDK purports to be a tool that helps app developers make money from ads in mobile apps. Used in an estimated 1,200 iOS apps that generate 300 million downloads per month, the iOS version of the library is said to contain malicious code designed to monitor user activity in order to facilitate what's known as attribution fraud.

To maximize mobile ad revenue, developers will often include third-party SDKs in their app code so the app works with multiple ad networks. Ad mediation platforms attempt to maximize the revenue for the app maker by choosing the optimal ad provider for each click and keeping track of which network gets credit for the interaction.

Attribution fraud occurs when someone tries to take credit for ad-related events – in this instance, clicks resulting in the installation of an advertised app – that should be attributed to another party.

"The Mintegral SDK is able to intercept all of the ad clicks (and other URL clicks as well) within the application," said Alyssa Miller, application security advocacy at Snyk, in a blog post on Monday.

"It uses this information to forge click notifications to the attribution provider. The forged notifications make it appear that the ad click came through their network even though it may have been a competing ad network that served the ad."

This not only steals advertising revenue that should have gone to other networks, says Miller, but also makes Mintegral appear to perform better than competing ad platforms, making it more attractive to developers.

What's more, Miller says that the SDK also captures sensitive data – the URL requested, which could include personally identifying information; the headers of the request, which could include auth tokens that incorporate personal data like email addresses; and the device's IDFA and IMEI identifiers.

China-based apps TikTok and WeChat recently got in trouble for less overtly dubious behavior, the undisclosed collection of personal information.

According to Miller, the Mintegral SDK includes anti-forensic capabilities designed to turn off malicious behavior when someone might be trying to analyze the code. It checks to see if the phone is rooted, or whether it can detect use of a proxy or debugging tools.

As Synk demonstrates in this video below, those investigating the app had to set flags on the server endpoint response to convince the app it wasn't being monitored.

Youtube Video

The Mintegral SDK, it's claimed, relies on a technique called method swizzling, a way of changing runtime functionality that involves injecting code into iOS event handlers to capture click events. The company logs that data to its server and registers a click notification with the attribution platform alongside the ad network that was actually responsible.

Thanks to what's known as the last-touch attribution model, where ad conversion credit goes to the provider closest to the user's action, Mintegral gets paid instead of the ad network that was actually responsible.

The malicious functionality supposedly has been present since version (5.5.1) of the iOS SDK was published on Jul 17, 2019. Snyk says the Android SDK doesn't exhibit bad behavior.

Apple, Mintegral, and Snyk did not immediately respond to requests for comment. ®

Updated to add

In a statement, the Beijing-based company denied Snyk’s claims, noting that, “Apple said it has spoken with Snyk researchers about their report, and that they have not seen any evidence the Mintegral SDK is harming users.”