April 2023 Summaries

Fingerprint has achieved ISO 27001 certification, reinforcing its dedication to data privacy and security following its earlier SOC 2 Type II compliance. ISO 27001, set by the International Organization for Standardization and the International Electrotechnical Commission, is a renowned standard for information security management systems, applicable to companies across various sizes and industries. This certification, obtained through an independent audit, signifies Fingerprint’s commitment to adhering to stringent data protection standards and minimizing data-related risks, aligning with its mission to empower developers in combating online fraud. For customers, this certification ensures that their data is managed with high-quality security processes, backed by annual independent audits to maintain the certification and uphold security practices.

This article introduces a technique for detecting an Apple ID region without user permissions through the use of Smart App Banners, which were introduced with iOS 6 to help developers promote their apps on the web. The Apple ID region, linked to a user's billing address, affects app availability, pricing, and access to services such as Apple Pay and Apple News. The article describes a method where attackers can perform a binary search over the 175 available regions in the App Store by using region-specific iOS applications and Smart App Banners, allowing them to pinpoint a user's exact country. This technique poses a privacy threat as it can contribute to fingerprinting, enabling third parties to track users across different platforms. The company, Fingerprint, clarifies that it does not employ this technique and advocates for open discussions to help browser providers address such vulnerabilities.