Keys To The City: The Trade-Off Between Revenue & Privacy In Monetizing SDKs

The talk looks at advertising SDKs, which let app developers earn revenue but bring third-party code into an app that the developer's own team may not fully vet. The speaker presents the research as an awareness effort rather than a verdict on any vendor, and acknowledges that monetization is a legitimate need. Background covers Android WebViews, the embedded browser components ad SDKs use to render content, and the settings that change how they behave.

The middle section walks through the risky configuration options: content access, JavaScript execution, loading local files, and the file-URL flags that let one local page read another file or reach network resources with the app's privileges. It also explains JavaScript interfaces, which expose Java methods to web content. Case studies follow. A malware-like SDK reported by a security vendor could list and read files, check clipboard data and probe for virtual machines. Three widely used SDKs, with install counts from 300 million to one billion, downloaded a remote HTML controller file, loaded it into a WebView with permissive file access, and in one case exposed more than 200 JavaScript methods. Those covered file deletion, device information and starting intents under the host app's identity.

The main takeaway is that an app's code can look harmless while the SDK's runtime behavior does not, so static review alone may miss what it does. Watching the WebView's network traffic can reveal more. The speaker stressed that the findings show capability rather than proven misuse, and encouraged developers to weigh revenue against privacy when choosing an SDK. Users were advised to be cautious with apps from unofficial sources and to notice intrusive advertising.