Malicious SDKs Caught Accessing Facebook and Twitter Users Data
SDKs are known as a software development toolkit. SDK is a software library that app developers embed in their code to automate certain operations, spare themselves from writing that specific code by hand and losing precious time.
SDKs are very popular in the modern app development ecosystem, but using an SDK also implies surrendering some of your app's control to a third-party entity.
Two third-party software development kits (SDKs) integrated by hundreds of thousands of Android apps have been caught holding unauthorized access to user's data associated with their connected social media accounts.
The two big social media platform i.e Twitter and Facebook disclose and released a statement revealing that an SDK from another company, Mobiburn have some malicious activity that might have exposed its users connected with certain Android apps to data collection firms.
On Monday, November 25, Twitter disclosed that they've received a report about an SDK made by data analytics platform OneAudience. The company offers a mobile SDK for Android and iOS apps that collect data on an app's users to provide additional insights for app makers about their audience.
Twitter also explained that "This issue is not due to a vulnerability in Twitter's software, but rather the lack of isolation between SDKs within an application,".
Twitter didn't say how many users were impacted but said that only Android users were affected, having no evidence that the data collection occurred from within iOS apps.
The social networking giant said it notified both Google and Apple about the SDK's secret user data harvesting capabilities, so the two app store owners can take their own action against apps using the OneAudience SDK.
The same issue also impacted Facebook, but the user data harvesting functions were spotted in two SDKs -- the first was the same OneAudience SDK, while the second was an SDK from data monetization platform MobiBurn.
The Facebook spokesperson said in a statement to CNBC that "After investigating, we removed the apps from our platform for violating our platform policies and issued cease and desist letters against One Audience and Mobiburn". a Facebook spokesperson said in a statement to CNBC, which broke the story yesterday.
The social network said it had "evidence that this SDK was used to access people's personal data." Collected information included email, username, and last tweet. A CNBC report suggested two of the apps where this data collection behavior was spotted were Giant Square and Photofy.
Comments
Post a Comment