More than 1,200 iPhone apps infected with malware — what you need to know

More one,200 iPhone apps infected with malware — what you need to know

(Image credit: Apple tree)

More than one,200 iPhone and iPad apps that are downloaded 300 million times every month contain malicious code that secretly steals user data and redirects ads, an application-security house says. Tt appears that the malicious lawmaking was able to, and may have been designed to, evade Apple'southward iOS app-screening procedures.

In a new written report released yesterday (Aug. 24), Boston-based Snyk says it discovered that the Mintegral software evolution kit (SDK) for iOS, an in-app advertising framework adult in China, logs the URL requests and request headers made by app users, either of which might include personal information.

The all-time Mac antivirus software
New iPhone 12 release date, price, specs and leaks
Merely in: iPhone 12 leak reveals a killer camera upgrade

"The scope of information being collected is greater than would be necessary for legitimate click attribution," Snyk'due south Alyssa Miller wrote in a Snyk company blog mail service yesterday. "The app also uses questionable coding methods to reach this level of data access."

Unfortunately, there'due south piddling iPhone or iPad users tin can do about this malware, which Snyk calls "SourMint." It won't be easy to make up one's mind from the user terminate whether an iOS app is using this particular advertising SDK.

Tom's Guide has reached out to Apple seeking annotate, and we will update this story when we receive a reply. Only ZDNet reported that Apple tree said it had no testify that the Mintegral SDK was negatively affecting iOS users.

How the malware works

Mintegral is just 1 of many advertizing SDKs in common use worldwide, and many mobile apps bundle in multiple SDKs to maximize ad revenue. Mintegral also makes an SDK for Android apps, but Snyk said it was not able to find whatsoever prove of malicious action past the SDK on Android.

The Mintegral SDK also commits advert fraud by hijacking other ad frameworks' advertising requests and claiming them as its ain, stealing revenue that should have gone to other parties.

"The Mintegral SDK is able to intercept all of the advertizing clicks (and other URL clicks every bit well) within the application," Miller wrote.

"It uses this information to forge click notifications to the attribution provider," Miller added. "The forged notifications arrive announced that the advert click came through their network fifty-fifty though it may have been a competing advertizement network that served the ad."

Ad fraud past itself doesn't impairment users, although it'due south illegal. But the logging of the URLs could disclose unique identifiers embedded in URLs to Mintegral, Snyk said, and the asking headers "could include authentication tokens and other sensitive data."

Information technology knows when information technology'south being watched

Furthermore, the Mintegral SDK seems to be trying to hide this activity: "If it finds evidence that it is being watched, the SDK modifies its beliefs in an apparent attempt to mask its malicious behaviors," Snyk wrote.

The malicious action will end if the SDK detects that it is running on a rooted phone or if debugging software is being used — both tools unremarkably used past security researchers.

"This may besides assist the SDK pass through Apple's app review process without existence detected," Miller noted.

"The attempts by Mintegral to muffle the nature of the data beingness captured, both through anti-tampering controls and a custom proprietary encoding technique, are reminiscent of similar functionality reported by researchers that analyzed the Tik Tok app," Miller added.

Paul Wagenseil is a senior editor at Tom'southward Guide focused on security and privacy. He has likewise been a dishwasher, fry cook, long-haul driver, lawmaking monkey and video editor. He's been rooting around in the information-security space for more than fifteen years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown upwards in random TV news spots and fifty-fifty moderated a panel discussion at the CEDIA dwelling-engineering science conference. You tin follow his rants on Twitter at @snd_wagenseil.