This'll upset the Apple cart: 1,200 iOS apps downloaded 300 million times a month include 'ad fraud' code

Synk accuses China-based Mintegral of distributing malicious SDK

Updated For over a year, a widely used code library from Chinese mobile ad biz Mintegral is alleged to have been covertly capturing data about app users' online interactions to steal ad revenue.

According to security biz Snyk, the Mintegral SDK purports to be a tool that helps app developers make money from ads in mobile apps. Used in an estimated 1,200 iOS apps that generate 300 million downloads per month, the iOS version of the library is said to contain malicious code designed to monitor user activity in order to facilitate what's known as attribution fraud.

To maximize mobile ad revenue, developers will often include third-party SDKs in their app code so the app works with multiple ad networks. Ad mediation platforms attempt to maximize the revenue for the app maker by choosing the optimal ad provider for each click and keeping track of which network gets credit for the interaction.

Attribution fraud occurs when someone tries to take credit for ad-related events – in this instance, clicks resulting in the installation of an advertised app – that should be attributed to another party.


Chrome Web Store slammed again after 295 ad-injecting, spammy extensions downloaded 80 million times


"The Mintegral SDK is able to intercept all of the ad clicks (and other URL clicks as well) within the application," said Alyssa Miller, application security advocacy at Snyk, in a blog post on Monday.

"It uses this information to forge click notifications to the attribution provider. The forged notifications make it appear that the ad click came through their network even though it may have been a competing ad network that served the ad."

This not only steals advertising revenue that should have gone to other networks, says Miller, but also makes Mintegral appear to perform better than competing ad platforms, making it more attractive to developers.

What's more, Miller says that the SDK also captures sensitive data – the URL requested, which could include personally identifying information; the headers of the request, which could include auth tokens that incorporate personal data like email addresses; and the device's IDFA and IMEI identifiers.

China-based apps TikTok and WeChat recently got in trouble for less overtly dubious behavior, the undisclosed collection of personal information.

According to Miller, the Mintegral SDK includes anti-forensic capabilities designed to turn off malicious behavior when someone might be trying to analyze the code. It checks to see if the phone is rooted, or whether it can detect use of a proxy or debugging tools.

As Synk demonstrates in this video below, those investigating the app had to set flags on the server endpoint response to convince the app it wasn't being monitored.

Youtube Video

The Mintegral SDK, it's claimed, relies on a technique called method swizzling, a way of changing runtime functionality that involves injecting code into iOS event handlers to capture click events. The company logs that data to its server and registers a click notification with the attribution platform alongside the ad network that was actually responsible.

Thanks to what's known as the last-touch attribution model, where ad conversion credit goes to the provider closest to the user's action, Mintegral gets paid instead of the ad network that was actually responsible.

The malicious functionality supposedly has been present since version (5.5.1) of the iOS SDK was published on Jul 17, 2019. Snyk says the Android SDK doesn't exhibit bad behavior.

Apple, Mintegral, and Snyk did not immediately respond to requests for comment. ®

Updated to add

In a statement, the Beijing-based company denied Snyk’s claims, noting that, “Apple said it has spoken with Snyk researchers about their report, and that they have not seen any evidence the Mintegral SDK is harming users.”

Keep Reading

Tech Resources

The State of Application Security 2020

Forrester analyzed the state of application security in 2020 and found over 75% of external attacks are attributed to web application and software exploits.

How backup modernization changes the ransomware game

If the thrill of backing up your data and wondering if you will ever see it again has worn off, start the new year by getting rid of the lingering pain of legacy backup. Bipul Sinha, CEO of the Cloud Data Management Company, Rubrik, and Miguel Zatarain, Director of Global Infrastructure Technology at PACCAR, Fortune 500 manufacturer of trucks and Rubrik customer, are talking to the Reg’s Tim Phillips about how to eliminate the costly, slow and spotty performance of legacy backup, and how to modernize your implementation in 2021 to make your business more resilient.

Webcast Slide Deck | Three reasons you need a hybrid multicloud

Businesses need their IT teams to operate applications and data in a hybrid environment spanning on-premises private and public clouds. But this poses many challenges, such as managing complex networking, re-architecting applications for the cloud, and managing multiple infrastructure silos. There is a pressing need for a single platform that addresses these challenges - a hybrid multicloud built for the digital innovation era. Just this Regcast to find out: Why hybrid multicloud is the ideal path to accelerate cloud migration.

Anatomy of a Private Cloud

Learn the key elements that combined, build a true Private Cloud

Biting the hand that feeds IT © 1998–2021