VUNGLE STORY SAGA CONTINUES

 

 
 
As a continuation of this saga on Vungle SDK, we suddenly got an email on September 2nd that our iMessenger 2.2 was suspended due to the presence of Vungle SDK. We were asked to update the app after removing this adware prior to removing the suspension. However, contrary to their finding, we believe that our latest version on the store that was uploaded on July 8th lacks Vungle SDK. 

To elaborate further, as shared in our previous article, we received a notification about the presence of Vungle SDK in our apps. As soon as we received that notification, we took action by working with the third-party provider to remove this adware way back in July. 

==================================================================

From: VAL-U-PRO CONSULTING GROUP, LLC - SRIKANTH KIDAMBI <srik.kid2012@gmail.com>
Date: Thu, Jun 25, 2020, 5:39 PM
Subject: Re: Notification from Google Play about iDiot Video Chat App
To: ####

Play Store Team:

May I know more about the malicious behaviour of the Vungle SDK? Vungle appears to be in place since 2012 with significant seed money invested then for this SDK company. Is there a specific Vungle adware that is a concern or is it for any app that includes Vungle that this concern has been raised? It is important for us to understand so that we can be careful about the nature of third-party SDKs to include in our app development process.

Here are the current numbers of Vungle that are in the Play Store:
AppswithVungle.png

Email to the third-party source offering the API/template

Team:

May I know whether any app update is available for the Vungle issue?

Also, were you able to recover FuntasticPhotos app?

Sincerely,
Srikanth.

We have sent an email to the Google Play store team to find out more in this regard. As your organization is also a concerned party in this regard, I am forwarding the email sent to the Google Play store team. (Please see email below)

Please keep me posted on when the update would become available.

We are also putting out a media article to share this issue with the users of our apps. We believe that it is our ethical responsibility to inform those users upfront. We will share the same with your team when that article gets published.

Srik Kid2012

Jun 29, 2020, 5:31 PM GMT+7

==================================================================

 Once that was done, we uploaded the new apk or the app file to the play store on July 8th as version 2.2. Prior to this addition, we also verified the manifest file to see whether we could locate the Vungle SDK and it was not found. Presented below are evidences supporting the same. We came up with this quick way to identify and verify the presence and absence of different add-ons on apps. 

For example, in the case of Vungle SDK on our iMessenger app, the left most image shows Vungle being found in the AndroidManifest file. This file corresponds to the version before the update and the one in the middle is the version post-update. In addition, we also utilized other tools out there to locate the Vungle SDK, and it was not found either. As a follow up to this issue, we are communicating back and forth with the Google Play Store team in this regard. To this point, the team keeps on suggesting to update the app, though not being clear on what evidential details that they have to support the presence of Vungle SDK.


Timeline:

1. June 24th: Received notification about the Vungle SDK issue from Google Play Store

2. June 25th: Communicated with the API/template provider

3. July first week: Third-party announced supposedly the Vungle SDK has been addressed

4. Right away, followed the instructions, but still noticed the adware, which we informed them.

5. When updated again later in the first week, I noticed that our app, iMessenger, was devoid of Vungle SDK. 

6. End of the first week of July: the updated version was uploaded to the play store

Where are we now?

==================================================================

Recent email of ours to the Play Store team

Good morning:

This is a follow up to our last email with regard to suspension of our iMessenger app for the reason that it includes Vungle SDK.

As pointed out in several emails, we took action right after when we first got notification in the summer of this year. In spite of all the confusion that is going on right now, we took action immediately and uploaded the updated file on July 8th. We also confirmed several times that the Vungle SDK was not there in the manifest file that was uploaded prior to releasing the latest version. We named that version 2.2 as per recommendation. After that, we might have even followed up requesting the team to confirm whether everything looks good or not, but never received any response. 

Now after almost two months, suddenly on September 2nd, we got an email saying that our app has been removed for the reason that the Vungle SDK is still intact in the app. Again, we went through the exercise to verify whether Vungle SDK is there or not, and we were unable to find it on the version uploaded on July 8th of this year. We also utilized different ad detectors out there, which also confirmed the same. We presented screenshots for the same showing the absence of Vungle SDK in the manifest file for the recently uploaded version, while there was Vungle SDK in our previous version. Even after producing these evidences, the removal team keep on asking us to upload the new version. 

What I am wondering is how could we upload a file without exactly knowing what the issue is? We have provided evidence of the absence of Vungle SDK in the manifest file and would appreciate some kind of evidence, which shows the presence of Vungle SDK from your end, which your team is claiming for removing our app. Please also provide details on how your team found it. Having this information would help us address the issue in hand.

From our end, we are producing the same evidences again. We have shared screenshots of the Android manifest files for the two versions uploaded to Google Play Console. The one that was uploaded prior to the July 8th version shows Vungle when searched for it. Whereas, the one uploaded on July 8th, 2020 shows not found result, while searching for the same search word. Considering so many projects that is going on for us concurrently, while having a lean team, we have found this quick, but effective way to determine presence and absence of an ad activity.

In addition, we are also showing results from one of the ad detectors output, which confirms the absence of Vungle SDK for the July 8th version.

I look forward to getting a clear explanation for removing our iMessenger app, which will give us confidence that there was a clear methodology in place to determine presence and absence of Vungle SDK that led to this decision.

By the way, while we are going through such scrutiny, may I know how come there is another iMessenger app that was not updated since 2019 still listed in the play store? This appears to be very similar to ours, though it was added after almost two years or so. Also, while searching iMessenger in the play store, that is the first app which shows up. However, ours need to be found only by adding Val-U-Pro in combination with iMessenger for it to be found. This was consistently happening for sometime and even a potential purchaser brought up this issue, which we shared earlier in the year with the removals team. The same removals team removed our app couple of years ago, when a third-party claimed our app name conflicting with theirs, though they had no app with a confusingly similar mark as ours in the Google Play Store. 

We also submitted a removals request form earlier in the summer requesting to take action to remove the other iMessenger app for this reason. Though our mark has a pending USPTO trademark application, the removals team negated our request to remove the mark. It makes us wonder whether this current suspension has any connection to that request of ours.

I look forward to a clear explanation in this regard.

Sincerely,
Srikanth.

VAL-U-PRO CONSULTING GROUP, LLC - SRIKANTH KIDAMBI

AttachmentsSat, Sep 5, 7:30 PM (22 hours ago)


 ================================================================
What else on this front are we working on?

We have been researching on various ad based tools network as an ongoing project for some time now. We have successfully figured out ways to clean up the entire network on android apps, especially for ours. We are in the process of wrapping up this work and then, we should be able to offer the cleaned versions as well for the end-consumers to pick and choose.

In addition, we will also be launching various apps that we have built over time without reliance on third-party platforms, majority of which was done by our founder, Dr Srikanth Srinivasan Kidambi, on our AmazeBaba platform.

==================================================================


 



Comments