Newsletter Q4 2023

Risk policy enhancements

• To increase the policy accuracy, we enhanced the transactional insight calculations related to the payee history. See Transaction Intelligence Parameters.

• We improved our social engineering detection by using enhanced models to detect fraud attacks that involve web-overlay techniques that perform malicious activities in the victim's account using their own device.

Efficacy

• To prevent issues resulting from incorrect data in hybrid application flows, Pinpoint introduces improvements to the consistency of the identification of the channel (mobile or online) in Pinpoint API requests.

• Improvements to the detection of the user journey in multi-login deployments. Pinpoint was enhanced to improve its ability to identify when users switch between online applications within the same multi-login deployment. See Multiple Login Flows.

API Health Check

To enable you to see whether the Pinpoint API servers are up, we provide a URL that you can use to check that the endpoint is active as part of your API development process. In this quarter, we added documentation about this health check option. See Pinpoint Deployment Health Check.

Stability

• To improve stability with the Pinpoint servers, we activated rate limits for test applications. Rate limits for test apps are applied only to apps that are designated as test applications. These rate limits are separate from any rate limits that apply to your apps in production. In addition, the rate limits for test apps are typically lower than the limits for production apps.

• When planning functional and non-functional testing of your application, make sure that you follow the testing guidelines. See Pinpoint Testing Guide.

Malware detection

We discovered a new type of malware that uses web injects that are used for stealing credentials and tricking users into installing remote access tools on their devices. The malware mainly targets customers in Latin America but was also seen in North America and Europe. We updated the policy with relevant “generic” signatures to detect the malware.

Apple privacy manifest support

Due to changes in Apple's privacy settings, starting Spring 2024, apps must describe their use of "required reason" APIs to be accepted by App Store Connect. This requirement applies to apps that use Mobile SDK, which must declare one or more approved reasons that accurately reflect your use of each of these APIs and the data that is derived from their use in the privacy manifest file. If you integrated Mobile SDK with your app using the XCFramework file, the privacy manifest is included and no further action is required.

Multiple app support

For some of our customers, we were able to provide a new feature that allows them to change the app ID during the application lifecycle. We provided this feature by adding a new API to Mobile SDK 5.9 that enables users to switch between apps without restarting Mobile SDK. For example, to switch between two different Pinpoint applications during the same Mobile SDK application lifecycle.

New attacks (signatures)

Mobile researchers detected and released notifications for the following campaigns:

• Grandoreiro - “Grandoreiro Malware Alert Targets Customers in LATAM”
• Tele.B - “New Campaign Alert of New Version of Tele (Tele.B) Targets Customers in Spain”

Security improvements

This release supports the signature verification of binary frameworks that is a new feature in Xcode 15.

Mobile SDK supported platform and versions

• Mobile SDK 5.5 and above are supported.

  From 7 March 2024, Mobile SDK 5.5 and all its minor versions will become unsupported.

  From 1 September 2024, Mobile SDK 5.6 and all its minor versions will become unsupported.

  For more information, see Support Lifecycle.

• Supported platforms (in supported Mobile SDK versions)

  • iOS - supports iOS 14 and later

  • Android - supports Android 8 and later

• Supported iOS development environments: Xcode 14.1 or later (aligned with Apple)

• Supported Android development environments: Android Studio 3.1.1 or later