I'm making a kids game & really want to respect the kids' privacy. I can't hand the keys to all that data & possible backdoors to some "free" third party library & just trust they will play nice.
https://lh3.ggpht.com/8gjIb24gOSjoLwxYvVgfFfMz9ItAT_0h86QRlY...
For the same reason that most responsible security researchers don't disclose zero-day threats: to prevent people from exploiting them before they can be fixed. In this case, they did notify Google, which can pull the compromised apps out of their app store and notify the developers who've used this library that they need to rewrite their apps.
The pixelization just reminds me of 'dodgy plumbers' on 'current affairs' shows or somesuch. I'm sure someone will recognize the pictured app eventually.
The ad library, who runs the code and expose the JS apis so that html ads can call it, proably advertise to its clients that they can do that.
So which actor exactly is being left out if they do not disclose? only the victims.
"We have analyzed all Android apps with over one million downloads on Google Play, and we found that over 1.8% of these apps used Vulna. These affected apps have been downloaded more than 200 million times in total."
