Researchers at FireEye have found that certain iOS versions of the Vpon mobile ad software development kit (SKD) contain code that could allow bad actors to remotely take command of certain mobile apps.
According to a FireEye blog post, Vpon is commonly marketed toward mainland Chinese and Taiwanese developers and app users. The dodgy Vpon SDKs under scrutiny here only pose a danger if they are integrated with AdsMogo, an ad serving platform designed to allow partner SDKs to integrate functionalities and behaviors they otherwise would not have. Unfortunately, this can also allow malicious actors to remotely take over up to 36 apps that FireEye discovered to be susceptible.
Once in control of these apps, bad actors can perform myriad malicious actions, including capturing audio, screenshots and videos; tracking a user's device location; exfiltrating data; launching additional apps; and more. Such malicious capabilities can be delivered via plug-ins for Apache Cordova, an open-source framework for hybrid app development.
