Hundreds Of Apps Banned From App Store For Accessing Users’ Personal Information

Hundreds of iOS applications have been pulled out of the App Store, following a report from analytics service SourceDNA, which uncovered a group of applications that were extracting users’ personally identifiable information, including email addresses associated with their Apple IDs, devices and peripheral serial numbers, as well as a list of apps installed on their phone. The applications in question had been using an SDK from a Chinese advertising company called Youmi which was accessing this information by way of private APIs, the report found.

Nearly all of the developers were located in China so, for now, this appears to be an isolated incident. However, the larger concern here has to do with how long this activity had been taking place – and what that means in terms of Apple’s App Store review process, given that it hadn’t caught this suspect activity until being alerted to it by a third party.

According to SourceDNA, Youmi had apparently been experimenting with what sort of information it could pull from users’ devices for some time. Nearly two years ago, for example, the firm began obfuscating a call to get the frontmost (currently running) app’s name – seemingly a small test of what it could sneak into the App Store. And when it realized that it was able to get this through Apple’s App Review process, it then began to use the same obfuscation technique to request other data, including the advertising ID.

The ad ID can be accessed for tracking ad clicks, but given that Youmi was surreptitiously collecting it, the firm may have been using it for other purposes, the report speculates.

In addition, SourceDNA noted that while Apple had been locking down private APIs in order to prevent apps from reading the platform serial number in iOS 8, Youmi worked around this by enumerating peripheral devices, like the battery system. It would then send those serial numbers as the hardware identifier.

SourceDNA, which helps app developers improve their code and address security flaws, says it found what Youmi was up to when it was updating its Searchlight product to check for use of private APIs – something that should get developers’ apps banned from the App Store. Surprisingly, it actually found quite a few apps that had gotten through.

In total, SourceDNA came across 256 apps with an estimated total of 1 million downloads that had been using a version of the Youmi SDK that was violating user privacy. However, the company adds it’s possible that the developers themselves didn’t realize what the SDK was doing, as the user data is uploaded to Youmi’s server.

What’s more concerning here is the implication of SourceDNA’s findings. The obfuscation method is fairly simple, the company says, and the apps have been using it for a long period of time. In fact, SourceDNA’s founder Nate Lawson tells us this has been going on for about a year-and-a-half.

“We’re concerned other published apps may be using different but related approaches to hide their malicious behavior,” a SourceDNA blog post states. “We’re continuing to add new features to our engine to discover anomalous behavior in app code and find out if this is the case.”

SourceDNA submitted its report to Apple, and Apple replied by offering the company a statement (see below) indicating the apps in question had been banned. Apple says it’s now working with developers who were using Youmi’s SDK to get their apps updated to be in compliance with Apple’s guidelines so they can return to the App Store.

Apple’s statement:

“We’ve identified a group of apps that are using a third-party advertising SDK, developed by Youmi, a mobile advertising provider, that uses private APIs to gather private information, such as user email addresses and device identifiers, and route data to its company server. This is a violation of our security and privacy guidelines. The apps using Youmi’s SDK have been removed from the App Store and any new apps submitted to the App Store using this SDK will be rejected. We are working closely with developers to help them get updated versions of their apps that are safe for customers and in compliance with our guidelines back in the App Store quickly.”

Comments

Use Cortana to define words for you in Windows 10

Microsoft’s Cortana has many uses including sending emails or checking the weather. One of the best uses though is a simple look-up feature for words and their definitions. Combined with the Hey Cortana voice recognition using Cortana to tell you quickly what a word means is a great hands-free tip. There are multiple ways to get Cortana to define a word. If you have Hey Cortana enabled you can simply blurt out your request: “Hey Cortana what is the meaning/definition of inchoate ?” “Hey Cortana define ubiquitously “ You can, of course, also just type in your request e.g “ define beatitude ” although this admittedly takes some of the speed (and fun) out of using the personal digital assistant. For many words, Cortana displays the definition within a card, and OxfordDictionaries or EncartaDictionaries powers it. Sometimes, if Cortana misunderstands you or does not have the definition, the assistant opens up a web page after performing a web search for...

Intel announces the first 14 nanometre processor

At the Computex conference in Taipei, chipmaker Intel has revealed a fanless mobile PC reference design using the first of its next-generation 14nm "Broadwell" processors. The 2 in 1 pictured here is a 12.5" screen that is just 7.2 mm thick with keyboard detached and weighs 670 grams. The Surface Pro 3 – for comparison – is 9.1 mm thick and weighs 800 grams. It includes a media dock that provides additional cooling for a burst of performance. The next-generation chip is purpose-built for 2 in 1s and will hit the market later in 2014 . Called the Intel Core M, it will be the most energy-efficient Intel Core processor in the company's history with power usage cut by up to 45 percent, resulting in 60 percent less heat. The majority of designs based on this new chip are expected to be fanless, with up to 32 hours of battery life, offering both a lightning-fast tablet and razor-thin laptop. Intel is also delivering innovation and performance for the ...

3D printing company New Matter is shutting down this month

Perhaps 2014 wasn’t the ideal time to get into the 3D printing game. After years of hype, the even the biggest names have been struggling to stay afloat. Pasadena startup New Matter is joining the growing list of companies who’ve unsuccessfully made a go at it, announcing that it will be closing up shop by the end of the month. It’s not for lacking of trying — and the company’s MOD-t printer was met with decent reviews when it launched in 2016. In his writeup, John praised the pricing ($300 or $400, depending on where you picked one up) and ease of use, though added cautiously, “you get what you pay for.” Initially funded on Indiegogo, the company went back to the crowdfunding well last year, this time taking to Kickstarter to pay for a Model 2. The project managed to exceed its goal in five days, but New Matter still pulled the plug. The company says it ultimately wanted to go back to the drawing board. “We have always strived to listen closely to our customers’ feedback, and...

Uber, Google and other tech employees form Coalition of Black Excellence

When black employee resource groups from a variety of tech companies come together, black magic happens. More specifically, black excellence happens. The Coalition of Black Excellence Week, spearheaded by Uber Litigation Counsel Angela Johnson in collaboration with black ERGs from over 40 tech companies like Facebook, Google, eBay, Lyft and Microsoft, kicks off this Monday in the San Francisco Yay (Bay) Area. The idea for CBE Week came in part from Johnson’s experiences living in Washington D.C., and being able to attend events put on by the Congressional Black Caucus, she told me at Uber’s headquarters this week. “When I moved out to the Bay Area, I really wished there were similar types of experiences for tech,” Johnson said. “And I thought if we could bring together different black ERGs, or diversity and inclusion committees, or people who were interested in some of the issues the black community is passionate about, a lot of positive change and impact could come from that....

New wearable tracker can transmit vital signs from a soft, tiny package

Body sensors have long been bulky, hard to wear, and obtrusive. Now they can be as thin as a Band-Aid and about as big as a coin. The new sensors, created by Kyung-In Jang, professor of robotics engineering at South Korea’s Daegu Gyeongbuk Institute of Science and Technology, and John A. Rogers, Northwestern University, consists of a silicone case that contains “50 components connected by a network of 250 tiny wire coils.” The silicone conforms to the body and transmits data on “movement and respiration, as well as electrical activity in the heart, muscles, eyes and brain.” This tiny package replaces many bulky sensor systems and because the wires are suspended in the silicone you are able to create a denser electronic. From the release: Unlike flat sensors, the tiny wires coils in this device are three-dimensional, which maximizes flexibility. The coils can stretch and contract like a spring without breaking. The coils and sensor components are also configured in an unusual spi...

Exciting Technology

Search This Blog