Researchers finger 256 iOS apps for privacy violations

[mmntech]

Researchers at SourceDNA have identified 256 apps which use the third-party Youmi ad SDK to silently collect user data without consent.

The advertising company collects things like device serial numbers, a list of apps installed on the device, hardware configurations, and email addresses associated with the user's Apple ID. All of which is in violation of Apple's App Store policy.

Once again, this appears to be mostly targeting Chinese iOS users. The official McDonalds' app for Chinese speakers was specifically fingered for using the Youmi network.

The SDK uses a digital cloak to obscure its data gathering functions from both users and developers. "McDonald's in China didn't do this on purpose. They installed this SDK to show ads, and the SDK vendor is using that privileged position in the app to collect data on all users who use their app," said Source DNA spokes person Nate Lawson.

Apple has responded to the allegations, saying they will remove all apps currently using the Youmi SDK, and will reject any future apps that still integrate it.

"We’ve identified a group of apps that are using a third-party advertising SDK, developed by Youmi, a mobile advertising provider, that uses private APIs to gather private information, such as user email addresses and device identifiers, and route data to its company server. This is a violation of our security and privacy guidelines. The apps using Youmi's SDK will be removed from the App Store and any new apps submitted to the App Store using this SDK will be rejected. We are working closely with developers to help them get updated versions of their apps that are safe for customers and in compliance with our guidelines back in the App Store quickly."

http://arstechnica.com/security/201...56-ios-apps-that-collect-users-personal-info/

 

[Oyeve]

No, Not apple! They are super secure!

 

[KeithP]

No, Not apple! They are super secure!

Well it is a relative scale. Compared to Android, even if they had problems like this every day, they would still be considered "super secure."

-KeithP

 

[Oyeve]

Well it is a relative scale. Compared to Android, even if they had problems like this every day, they would still be considered "super secure."

-KeithP

And yet no one has been affected on either side.

 

[crankytinkle]

scary..