Code analytics platform SourceDNA has found hundreds of apps on the App Store that used private APIs to collect private user data, like email addresses and device identifiers, slipping under Apple’s radar in the approval process. The code got into these apps through the inclusion of a mischievous third-party advertising SDK, which secretly stored this data and sent it off to its own servers.
Apple has now verified the SourceDNA report and is removing all of the apps that included the advertising SDK from the store, as using private API calls is a breach of App Review Guidelines. Apple has also patched its approval processes to prevent any more apps that use this technique to make it onto the App Store.
The SDK under examination comes from a Chinese advertising company, Youmi. SourceDNA used its own binary search tools to find 256 apps that included the unscrupulous SDK, which have received over a million downloads in total.
The SDK used a variety of techniques and APIs to collect identifying personal information it shouldn’t normally be able to. This includes serial numbers, peripheral serial numbers, lists of installed apps and obtaining the user’s Apple ID email. The analytics company speculates Youmi became more confident with its methods over time, slowly adding more and more data collection code over a two-year span.
In this instance, almost all of the offending apps were targeted at the Chinese market. However, given that evasion of Apple’s app review process has been going on for many months, SourceDNA is concerned that there may be other cases of similar bad behavior already on the App Store, as yet undetected.
This is Apple’s full statement on the matter.
