Hundreds Of Apps Banned From App Store For Accessing Users’ Personal Information

Hundreds of iOS applications have been pulled out of the App Store, following a report from analytics service SourceDNA, which uncovered a group of applications that were extracting users’ personally identifiable information, including email addresses associated with their Apple IDs, devices and peripheral serial numbers, as well as a list of apps installed on their phone. The applications in question had been using an SDK from a Chinese advertising company called Youmi which was accessing this information by way of private APIs, the report found.

Nearly all of the developers were located in China so, for now, this appears to be an isolated incident. However, the larger concern here has to do with how long this activity had been taking place – and what that means in terms of Apple’s App Store review process, given that it hadn’t caught this suspect activity until being alerted to it by a third party.

According to SourceDNA, Youmi had apparently been experimenting with what sort of information it could pull from users’ devices for some time. Nearly two years ago, for example, the firm began obfuscating a call to get the frontmost (currently running) app’s name – seemingly a small test of what it could sneak into the App Store. And when it realized that it was able to get this through Apple’s App Review process, it then began to use the same obfuscation technique to request other data, including the advertising ID.

The ad ID can be accessed for tracking ad clicks, but given that Youmi was surreptitiously collecting it, the firm may have been using it for other purposes, the report speculates.

In addition, SourceDNA noted that while Apple had been locking down private APIs in order to prevent apps from reading the platform serial number in iOS 8, Youmi worked around this by enumerating peripheral devices, like the battery system. It would then send those serial numbers as the hardware identifier.

SourceDNA, which helps app developers improve their code and address security flaws, says it found what Youmi was up to when it was updating its Searchlight product to check for use of private APIs – something that should get developers’ apps banned from the App Store. Surprisingly, it actually found quite a few apps that had gotten through.

In total, SourceDNA came across 256 apps with an estimated total of 1 million downloads that had been using a version of the Youmi SDK that was violating user privacy. However, the company adds it’s possible that the developers themselves didn’t realize what the SDK was doing, as the user data is uploaded to Youmi’s server.

What’s more concerning here is the implication of SourceDNA’s findings. The obfuscation method is fairly simple, the company says, and the apps have been using it for a long period of time. In fact, SourceDNA’s founder Nate Lawson tells us this has been going on for about a year-and-a-half.

“We’re concerned other published apps may be using different but related approaches to hide their malicious behavior,” a SourceDNA blog post states. “We’re continuing to add new features to our engine to discover anomalous behavior in app code and find out if this is the case.”

SourceDNA submitted its report to Apple, and Apple replied by offering the company a statement (see below) indicating the apps in question had been banned. Apple says it’s now working with developers who were using Youmi’s SDK to get their apps updated to be in compliance with Apple’s guidelines so they can return to the App Store.

Apple’s statement:

“We’ve identified a group of apps that are using a third-party advertising SDK, developed by Youmi, a mobile advertising provider, that uses private APIs to gather private information, such as user email addresses and device identifiers, and route data to its company server. This is a violation of our security and privacy guidelines. The apps using Youmi’s SDK have been removed from the App Store and any new apps submitted to the App Store using this SDK will be rejected. We are working closely with developers to help them get updated versions of their apps that are safe for customers and in compliance with our guidelines back in the App Store quickly.”

Comments

Peel Turns Your Apple Watch Into A Universal Remote Control

Does it make sense to use your Apple Watch as a remote control for your media devices? Smart remote maker Peel thinks so, having just launched a universal remote control application for the Apple Watch which lets you operate over 400,000 models of home electronics, including not only televisions, but also DVD players, and even audio and streaming devices, like the Roku. The Apple Watch app is actually an extension of the company’s existing smart remote app for iPhone . And while in a few cases the new Watch app will allow you to control your devices via Wi-Fi, for the most part, it will require the Pronto hardware just like the iPhone version does. The Pronto 360-degree IR blaster is what turns the iPhone, and now the Apple Watch, into a smart universal remote control. A $49.99 piece of hardware about the size of a salt shaker, Pronto sits in your entertainment center to provide the IR capabilities required to operate your TV and other electroni...

Barnes & Noble is killing itself

I’ve been chronicling the slow demise of B&N for years now, watching the company bleed out, drop by drop, until it has become a shell of its former value. B&N was a cultural center in places without cultural centers. It was a stopover on rainy days in New York, Chicago, and Cleveland and it was a place you could go to get your kids’ first books. That’s mostly over now. On Monday the company laid off 1,800 people. This offered a cost savings of $40 million. But that’s particularly interesting. That means each of those people made an average of $22,000 or so per year and minimum wage workers – hourly folks who are usually hit hardest during post-holiday downturns – would be making $15,000. In fact, what B&N did was fire all full time employees at 781 stores. From a former employee: On Monday morning, every single Barnes & Noble location told their full-time employees to pack up and leave. The eliminated positions were as follows: the head cashiers (those are the pe...

Intel announces the first 14 nanometre processor

At the Computex conference in Taipei, chipmaker Intel has revealed a fanless mobile PC reference design using the first of its next-generation 14nm "Broadwell" processors. The 2 in 1 pictured here is a 12.5" screen that is just 7.2 mm thick with keyboard detached and weighs 670 grams. The Surface Pro 3 – for comparison – is 9.1 mm thick and weighs 800 grams. It includes a media dock that provides additional cooling for a burst of performance. The next-generation chip is purpose-built for 2 in 1s and will hit the market later in 2014 . Called the Intel Core M, it will be the most energy-efficient Intel Core processor in the company's history with power usage cut by up to 45 percent, resulting in 60 percent less heat. The majority of designs based on this new chip are expected to be fanless, with up to 32 hours of battery life, offering both a lightning-fast tablet and razor-thin laptop. Intel is also delivering innovation and performance for the ...

What is your preferred smartphone screen size

Screen envy. We all have it. Or do we? See, that’s the thing, I’m just not so sure. One thing I am sure about is that our phone screens have gotten progressively bigger and bigger over the last few years. The funny thing is, we as a society have taken that ball and run with it, like we just don’t care. But I always thought we did care? Some time ago, when phones were in the sub-5” range, we used to have a term called “phablet” which described an almost absurdly big phone. The definition varied from person to person. I always considered a phone with a screen 5.5” or bigger to be a phablet. The Galaxy Note fell into that category. The Lumia 1520 certainly did. There are others as well. I was safely ensconced in the 4.5” area at the time with my Lumia 920. What did I know? Leon’s getting laaaaaaaarrrger But slowly, phones started topping the 5” mark. I’m not talking about phablets here, I’m talking about normal flagship phones – the Galaxy S4 (barely) and the HTC One (M7) are ...

Airbnb will open its Cuba listings to users outside the United States

Airbnb will now let travelers from outside the U.S. to book properties in Cuba after receiving authorization from the U.S. government, reports the Associated Press . Previously, only Americans were allowed to reserve the site’s Cuban listings . They will open to international users on April 2. Airbnb launched its Cuban operations in April 2014 , four months after the Obama administration revealed that it will begin to restore diplomatic relations with the Communist country . The historic policy change means that travel and trade sanctions will be lifted , which is expected to boost tourism to Cuba dramatically because Americans no longer need licenses to visit. In fact, President Obama is currently on an official visit to Cuba , the first president since Calvin Coolidge to do so. According to the AP, Cuba is currently Airbnb’s fastest-growing market, with about 4,000 homes added since it opened listings. Other travel businesses...

Exciting Technology

Search This Blog