Programming Error Exposes iOS Apps: What Happened

A programming error in a widely used software development kit (SDK) exposed data from thousands of iOS apps, potentially leaking user information to third parties. The flaw, discovered in early 2024, stemmed from a misconfigured cloud storage bucket that allowed unauthorized access to app data. This article explains the technical details, the scope of the exposure, and what developers and users should do now.

Background: The SDK and the Misconfiguration

The incident involved a popular SDK used by thousands of iOS apps for analytics, push notifications, or advertising. The SDK’s developers had set up a cloud storage bucket (likely Amazon S3 or Google Cloud Storage) to hold configuration files and, in some cases, user data. A programming error in the SDK’s code caused it to write data to a publicly readable bucket instead of a private one. This meant anyone with the bucket’s URL could list and download its contents without authentication.

Security researchers discovered the exposed bucket and reported it to the SDK vendor. The vendor quickly restricted access, but not before the data had been publicly accessible for an unknown period. The incident highlights a common but dangerous mistake: defaulting to public access in cloud storage configurations.

How the Exposure Happened

The root cause was a simple oversight in the SDK’s code. When the SDK initialized, it generated a unique identifier for each app installation and stored it in a cloud bucket. The code used a default access control list (ACL) that made the bucket publicly readable. This is a classic example of a “misconfigured bucket” — a leading cause of data breaches in cloud environments.

Specifically, the SDK’s code likely contained something like:

storage.bucket('app-data').upload(file, { public: true })

Instead of setting the ACL to private. This single line exposed any data written to that bucket. The data included device tokens, user IDs, and in some cases, email addresses or other personal information that apps had passed to the SDK.

Scope: How Many Apps Were Affected?

Security researchers estimated that thousands of iOS apps were affected, possibly over 10,000. The exact number is hard to pin down because the SDK was embedded in many apps, and the exposed bucket contained data from all of them. The researchers found the bucket by scanning for common misconfigurations, and they were able to access data from a wide range of app categories, including banking, health, and social media apps.

Not every app using the SDK was necessarily affected — only those that had triggered the code path that wrote to the public bucket. However, the researchers noted that a significant portion of apps using the SDK were vulnerable.

What Data Was Exposed?

The exposed data varied depending on what the app sent to the SDK. Common data points included:

Device identifiers (IDFA, IDFV)
Push notification tokens
User email addresses (if the app passed them)
Location data (if the app requested it)
In-app purchase receipts

This information could be used for targeted phishing, spam, or even account takeover if combined with other leaked data. However, the researchers noted that no passwords or credit card numbers were found in the exposed bucket.

Timeline and Response

The exposure was discovered in February 2024 by a security research firm that regularly scans for misconfigured cloud buckets. They found the bucket and immediately attempted to contact the SDK vendor. After several days without a response, they published a limited disclosure to alert affected developers. The vendor eventually responded and fixed the issue by making the bucket private.

Apple was also notified, but the company does not have a mechanism to remotely patch apps that use vulnerable SDKs. Instead, Apple relies on developers to update their apps. The SDK vendor released an updated version with a fix, but it was up to each app developer to integrate the update and resubmit their app to the App Store.

How to Check if You’re Affected

For users, there’s no easy way to know if a specific app was affected. The best course of action is to:

Update all your apps to the latest versions.
Check the app’s privacy policy or developer website for any mention of the SDK.
Be cautious of unsolicited emails or messages that reference your app usage.

For developers, the fix is more direct:

Identify which SDK version you’re using.
Check the SDK vendor’s advisory for affected versions.
Update to the patched version and resubmit your app.

Preventing Similar Issues

This incident serves as a reminder of the importance of secure cloud storage configurations. Developers should:

Always set ACLs to private by default.
Use infrastructure-as-code tools to audit bucket permissions.
Regularly scan for public buckets using tools like ScoutSuite or Pacu.
Implement least-privilege access for all cloud resources.

For users, there’s little you can do beyond staying vigilant and updating apps. The onus is on developers and SDK vendors to follow security best practices.

Frequently Asked Questions

Which SDK was involved?

The specific SDK was not widely named in public disclosures, but it was a popular third-party SDK used for analytics and push notifications. The vendor has since released a fix.

Can I tell if my data was leaked?

Not directly. You can’t see the contents of the bucket. However, if you receive suspicious emails or messages that reference your app usage, it’s possible your data was exposed.

Should I delete the affected apps?

Not necessarily. If you’ve updated the app to the latest version, the vulnerability is likely patched. If you’re concerned, you can contact the app developer for more information.

Is this a problem with Apple’s iOS?

No. This is a third-party SDK issue. Apple’s iOS itself was not vulnerable. The problem lies with how the SDK handled data storage.

How can I protect myself now?

Change passwords for accounts associated with affected apps, enable two-factor authentication, and monitor your accounts for unusual activity. Also, be wary of phishing attempts that may use your leaked data.

Will Apple remove affected apps from the App Store?

Apple typically doesn’t remove apps for SDK vulnerabilities unless they remain unpatched for a long time. Most developers updated quickly, so the apps remain available.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →