Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Security Strategy, Plan, Budget, Vulnerability Management, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Risky code in Vpon SDKs leaves mobile apps prone to malicious takeovers

Researchers at FireEye have found that certain iOS versions of the Vpon mobile ad software development kit (SKD) contain code that could allow bad actors to remotely take command of certain mobile apps.

According to a FireEye blog post, Vpon is commonly marketed toward mainland Chinese and Taiwanese developers and app users. The dodgy Vpon SDKs under scrutiny here only pose a danger if they are integrated with AdsMogo, an ad serving platform designed to allow partner SDKs to integrate functionalities and behaviors they otherwise would not have. Unfortunately, this can also allow malicious actors to remotely take over up to 36 apps that FireEye discovered to be susceptible.

Once in control of these apps, bad actors can perform myriad malicious actions, including capturing audio, screenshots and videos; tracking a user's device location; exfiltrating data; launching additional apps; and more. Such malicious capabilities can be delivered via plug-ins for Apache Cordova, an open-source framework for hybrid app development.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.