As part of our work to identify and systematically analyze data sharing in mobile apps in the K-12 app space,we recently uncovered significant risks posed by mobile apps with the Yandex Appmetrica SDK installed.  The Me2B Alliance is proud that the Financial Times has picked up on this research and published a critical article outlining these risks.

As the article outlines and our research has found, there is no way for anyone using either the Google or Apple app stores to know which apps have the Yandex Appmetrica SDK installed. In our previous reports, we have urged Apple and Google to make the SDK within those apps visible to the public, so that people can make informed decisions on whether to install an app based on specific vendors. Unfortunately, neither Apple nor Google have made the necessary transparency changes to SDKs installed in apps, so we do not have any “easy advice” to avoid the 52,000+ apps using the Yandex Appmetrica SDK.

In the meantime, to help identify these risks, we’ve provided a simple list (below) of VPN apps, or Virtual Private Network apps, which people install to protect their privacy and security, often used by people with elevated risk profiles. This list was downloaded on March 28, 2022, from the AppFigures database. These apps have the Appmetrica SDK installed within them – which means that these apps likely have the Appmetrica SDK activated and are probably sending data to Yandex servers.

As the Financial Times article explained, any mobile apps providing VPN services, which also have the Yandex Appmetrica SDK installed within them, are unsafe:  

“Conversely, more than 2,000 apps have added the AppMetrica SDK since the invasion of Ukraine, including several that appear designed to track Ukrainian users. “Call Ukraine,” for instance, is a “free messenger for Ukrainians” that launched in the Play Store on March 10 using the blue and yellow flag as its icon. Once downloaded, the app can see a user’s identity and read their contacts. The developer includes a dummy email address: “help.service@internet.ru.”

Cher Scarlett [formerly a principal software engineer in global security at Apple], said it was concerning that AppMetrica was installed in 21 VPN apps just in the past 30 days. “You’re trying to be proactive in being more safe,” she added, “but actually making yourself more vulnerable”.

We believe significantly more time and resources need to be dedicated to researching data supply chains within mobile apps to ensure that all vendors within the supply chain are known and disclosed. We continue to dig into these issues, and we look forward to additional conversations about other SDKs and risks in the future.

If you have any additional questions, concerns, or edits? Please reach out to our team at contact@internetsafetylabs.org.

List of VPN apps with Yandex Appmetrica SDK

Twenty six of the apps listed below were first uploaded into either the iOS or Android store after February 1, 2022, and is sorted by “release date” to further highlight the timing.

If you are using one of these VPN’s your data could be vulnerable.