一、第三方SDK的业内现状 9 (一)第三方SDK常见类型及应用情况 9 (二)第三方SDK安全标准化现状 23 (三)第三方SDK普遍应用的原因分析 25 二、第三方SDK的主要安全问题及分析 26 (一)第三方SDK自身安全性不容乐观 26 (二)第三方SDK成为病毒传播新途径 27 (三)第三方SDK隐蔽收集个人信息问题逐步显现 27 三、第三方SDK的主要合规问题及分析 28 (一)第三方SDK作为数据处理者时,主要合规问题分析 28 (二)第三方SDK作为数据控制者时,主要合规问题分析 30 四、第三方SDK管理的域外经验 31 (一)欧盟的第三方SDK管理经验 31 (二)美国的第三方SDK管理经验 36 五、针对我国第三方SDK管理的相关建议 41 (一)尽快完善相关法律法规,明确相关主体的责任义务 41 (二)App开发者需要积极履行数据合规义务 43 (三)第三方SDK提供者需要加快构建数据安全合规体系 52 (四)加快完善SDK安全管理的主体责任 55 (五)鼓励第三方SDK企业开展行业自律 56 附录 第三方SDK产品的安全与合规实践 57 (一)极光SDK的安全与合规实践 57 (二)小米推送SDK的安全与合规实践 65 (三)TalkingData SDK的安全与合规实践 69

前 言 2 声 明 2 摘 要 4 1.适用范围 6 2.第三方SDK概述 6 3.第三方SDK安全问题 8 3.1 第三方SDK自身安全漏洞 8 3.2 恶意第三方SDK 8 3.3 第三方SDK违法违规收集App用户的个人信息 10 4.措施建议 10 4.1 对App提供者 10 4.2 对第三方SDK提供者 13 附录A 常见第三方SDK安全漏洞 16 附录B 第三方SDK告知同意 18

致谢 3 序言 4 目录 5 1 数字货币钱包分类使用场景 6 2 数字钱包安全风险分析 8 2.1数字钱包使用过程安全分析 9 2.2 数字钱包开发&应用技术安全分析 10 3.数字钱包安全案例分析 13 3.1数字钱包安全事件回溯 13 3.2用户安全使用引导 13 3.3数字钱包安全设计 14 4数字钱包安全设计应用实践 15 4.1无私钥钱包用户需求分析 15 4.2企业级数字资产钱包需求分析 20 5. 数字钱包安全测试标准 25 参考文献 37 关于云安全联盟大中华区 38

BC_TOC_START 3 BC_TOC_END 4 FDP_10006704_301467_200717_615125788 23 FDP_10002112_301468_200717_206153361 24 FDP_10006600_297236_200717_1425625904 25 FDP_10007260_301673_200717_455905624 26 FDP_10006864_301465_200717_477280696 27 FDP_10005845_301459_200717_1598721060 28 FDP_10002513_301460_200717_358995114 29 FDP_10006828_301462_200717_1474249186 30 FDP_10006669_301464_200717_71025548 31 eraMarker_DiscAll 32

慧博投研资讯 - www.hibor.com.cn 慧博投研资讯,-,www.hibor.com.cn

Introduction 4 CHAPTER 1 5 Open Season on Open Source 5 Software Supply Chain Attacks: Past and Future 6 Rise of Next-Gen Software Supply Chain Attacks (2015-2020) 7 Speed Remains Critical When Responding to Legacy Software Supply Chain Attacks 10 CHAPTER 2 12 Open Source: Supply and Demand 12 JavaScript 13 Java 14 .NET 14 DockerHub 14 Chapter 3 15 Identifying Exemplary Open Source Suppliers 15 Researching the Best Performing OSS Projects 16 Finding Different Behavioral Groups 16 Exemplars 16 Laggards 17 Cautious Teams 17 Projects with Updated Dependencies Are More Secure 18 Guidance for Open Source Project Owners and Contributors 19 Guidance for Enterprise Development Teams 19 Chapter 4 20 How High Performance Teams Manage Open Source Software Supply Chains 20 Survey of Open Source Management Practices 21 Comparing High Performers vs. Low Performers 23 Comparing High Performers vs. Security First 23 Variables Most Impacting Performance and Risk Management 24 Influencing Risk Management Outcomes 24 Influencing Productivity Outcomes 26 Influencing Job Satisfaction 27 Guidance for Enterprise Development Teams 27 Patterns Across OSS Component Updates: Easy, Difficult, and Planned 28 Chapter 5 31 The Trust and Integrity of Software Supply Chains 31 1 in 10 OSS Downloads Are Vulnerable 32 Enterprises Rely on Code from 3,500 Suppliers, But Quality Varies 33 OSS Components Make Up 90% of a Modern Application 33 21% of Enterprises Experienced Open Source Breaches 34 Chapter 6 35 The Changing OSS Landscape: Social Activism and Government Standards 35 Social Activism and Open Source Software 36 Governments Apply New Standards to Secure Software Supply Chains 36 United States 36 United Kingdom 38 Australia 39 Summary 40 Sources 41 Appendix A 42 Appendix B 43

The big picture -1 The view at ground level -1 Initiate coverage -1 Why read this report? 2 Intelligent Connected Vehicles and 5G 4 Executive summary 5 At the forefront of China’s technological transformation 5 Software spending is set to increase 6 Smart cockpits and high-definition (HD) maps 6 Promising outlook for intelligent road networks 7 Initiate coverage on three companies 8 Thunder Software (300496 CH, CMP RMB98.46, Buy, TP RMB128.00) 9 TransInfo Technology (002373 CH, CMP RMB18.12, Buy, TP: RMB29) 10 NavInfo (002405 CH, CMP RMB14.70, Hold, TP: RMB16) 11 How we are different from market expectations 11 Sector catalysts and downside risks 12 Potential sector catalysts 12 Sector downside risks 13 Environmental, social and governance 13 Environmental protection 13 Social responsibility 13 Corporate governance 14 Valuation and risks 19 Policy support the key 20 The ICV ecosystem and related policies 20 China’s ICV industry: empowered by 5G-based C-V2X 22 ICV a key enabler of autonomous driving 25 CVIS likely to be the mainstream autonomous driving technology path 26 Infrastructure boost to benefit intelligent road networks 26 All systems go 28 Acceleration of intelligent vehicle innovation, with the proportion of investment in software increasing 28 Commercialisation of smart cockpits and HD maps is underway 29 HD maps for automated driving 31 Company section 34 Thunder Software (300496 CH) 35 Platform software player benefits from intelligent Internet growth 35 Shareholding structure 35 Business outlook 36 Harvest season for the smart vehicle business 36 5G development benefits smart software and IoT business 38 5G to drive smart software business to a new growth cycle 38 The benefits of co-operating with Qualcomm 40 Earnings forecasts 40 Smart vehicle business 40 Smart IoT business 41 Smart software business 41 Valuation and risks 44 Initiate coverage with a Buy rating and a TP of RMB128 44 Potential share price catalysts 45 Key downside risks 45 TransInfo Technology (002373 CH) 47 Main beneficiary of smart road network construction 47 Shareholding structure 47 Business outlook 48 The next stage of road intelligence; room for informatisation investment to rise 48 Xueliang Project and overseas expansion to boost earnings of subsidiary Uniview 50 Business synergies from the investment by Alibaba 51 Earnings forecasts 52 Smart transport 52 Smart IoT 52 We are below consensus 53 Valuation and risks 54 Initiate coverage with a Buy rating and a TP of RMB29 54 Potential share price catalysts 55 Key downside risks 55 NavInfo (002405 CH) 57 All roads lead to intelligent connected vehicles 57 Shareholding structure 58 Business outlook 59 Recovery in passenger vehicle sales positive for navigation and auto chip businesses 59 AutoChips: An important acquisition 59 The connected commercial vehicle business 60 Bullish on HD map business over the long term 61 Earnings estimates 61 Expense ratios 63 We are below consensus 63 Valuation and risks 64 Initiate coverage with a Hold rating and a target price of RMB16 64 Chip business 64 Non-chip business 65 Key upside risks: 66 Key downside risks 66 Disclosure appendix 68 Analyst Certification 68 Important disclosures 68 Equities: Stock ratings and basis for financial analysis 68 From 23rd March 2015 HSBC has assigned ratings on the following basis: 68 Prior to this date, HSBC’s rating structure was applied on the following basis: 68 Rating distribution for long-term investment opportunities 69 As of 15 December 2020, the distribution of all independent ratings published by HSBC is as follows: 69 HSBC & Analyst disclosures 69 Additional disclosures 70 Production & distribution disclosures 70 Disclaimer 71 The big picture -1 The view at ground level -1 Initiate coverage -1 Why read this report? 2 Intelligent Connected Vehicles and 5G 4 Executive summary 5 At the forefront of China鈥檚 technological transformation 5 Software spending is set to increase 6 Smart cockpits and high-definition (HD) maps 6 Promising outlook for intelligent road networks 7 Initiate coverage on three companies 8 Thunder Software (300496 CH, CMP RMB98.46, Buy, TP RMB128.00) 9 TransInfo Technology (002373 CH, CMP RMB18.12, Buy, TP: RMB29) 10 NavInfo (002405 CH, CMP RMB14.70, Hold, TP: RMB16) 11 How we are different from market expectations 11 Sector catalysts and downside risks 12 Potential sector catalysts 12 Sector downside risks 13 Environmental, social and governance 13 Environmental protection 13 Social responsibility 13 Corporate governance 14 Valuation and risks 19 Policy support the key 20 The ICV ecosystem and related policies 20 China鈥檚 ICV industry: empowered by 5G-based C-V2X 22 ICV a key enabler of autonomous driving 25 CVIS likely to be the mainstream autonomous driving technology path 26 Infrastructure boost to benefit intelligent road networks 26 All systems go 28 Acceleration of intelligent vehicle innovation, with the proportion of investment in software increasing 28 Commercialisation of smart cockpits and HD maps is underway 29 HD maps for automated driving 31 Company section 34 Thunder Software (300496 CH) 35 Platform software player benefits from intelligent Internet growth 35 Shareholding structure 35 Business outlook 36 Harvest season for the smart vehicle business 36 5G development benefits smart software and IoT business 38 5G to drive smart software business to a new growth cycle 38 The benefits of co-operating with Qualcomm 40 Earnings forecasts 40 Smart vehicle business 40 Smart IoT business 41 Smart software business 41 Valuation and risks 44 Initiate coverage with a Buy rating and a TP of RMB128 44 Potential share price catalysts 45 Key downside risks 45 TransInfo Technology (002373 CH) 47 Main beneficiary of smart road network construction 47 Shareholding structure 47 Business outlook 48 The next stage of road intelligence; room for informatisation investment to rise 48 Xueliang Project and overseas expansion to boost earnings of subsidiary Uniview 50 Business synergies from the investment by Alibaba 51 Earnings forecasts 52 Smart transport 52 Smart IoT 52 We are below consensus 53 Valuation and risks 54 Initiate coverage with a Buy rating and a TP of RMB29 54 Potential share price catalysts 55 Key downside risks 55 NavInfo (002405 CH) 57 All roads lead to intelligent connected vehicles 57 Shareholding structure 58 Business outlook 59 Recovery in passenger vehicle sales positive for navigation and auto chip businesses 59 AutoChips: An important acquisition 59 The connected commercial vehicle business 60 Bullish on HD map business over the long term 61 Earnings estimates 61 Expense ratios 63 We are below consensus 63 Valuation and risks 64 Initiate coverage with a Hold rating and a target price of RMB16 64 Chip business 64 Non-chip business 65 Key upside risks: 66 Key downside risks 66 Disclosure appendix 68 Analyst Certification 68 Important disclosures 68 Equities: Stock ratings and basis for financial analysis 68 From 23rd March 2015 HSBC has assigned ratings on the following basis: 68 Prior to this date, HSBC鈥檚 rating structure was applied on the following basis: 68 Rating distribution for long-term investment opportunities 69 As of 15 December 2020, the distribution of all independent ratings published by HSBC is as follows: 69 HSBC & Analyst disclosures 69 Additional disclosures 70 Production & distribution disclosures 70 Disclaimer 71 (as-gbk-encoding)