Its interesting that the Amazon app requests more questionable permissions than TikTok
TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
31–40 of 82 posts
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#32As I said in another comment, I would not be surprised if TEMU is spyware.
This website is questionable and I could really only find this other source or ones like it: https://www.usatoday.com/story/tech/columnist/komando/2023/0...
Still light on details and Im not sure who this Komanda person is but there is some real appeal to authority going on and no hard evidence of the claims.
Again, I would not be surprised if it was spyware and it seems wise to be suspicious. Hopefully we get more information.
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#33A bit off topic, but this website has some of the most draconian TOS I've ever seen > You agree that the information on this website is copyrighted, and you therefore agree not to distribute this information (whether the downloaded _le, copies / images / reproductions, or the link to these _les) in any manner other than by providing the following link: http://GRIZZLYREPORTS.COM So this HN submission is in violation o…
That's a Securities and Exchange Commission compliance thing. Grizzly advises investors for pay, and they have to disclose that they do so. Companies on their list are quite likely to sue them. And lose.
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#34Earlier quoted context omitted.
I did find the table comparing its permissions to others in the space...enlightening. My kid bought something from Temu recently and it was ridiculously low-priced. I told him the quality must be terrible...and I was wrong. I was kind of shocked and wondered what the "catch" was. Of course, I hadn't installed the app but wow, now I have the heebie-jeebies just thinking about it.
It's likely cheap because it's made with forced labor: https://apnews.com/article/temu-shein-forced-labor-china-de7...
Temu doesn't make stuff, they sell stuff. They sell the exact same stuff you can get on aliexpress, Amazon, and WalMart.
If there's forced labor it's not specific to them, it's specific to China.
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#35I'm not exactly an Android expert but... android.permission.INSTALL_PACKAGES, getRuntime.exec()... these basically are permissions for remote code execution, are they not? I think this blogpost is hyperbolic in its discussion and that's a bit unhelpful. But this does look like a serious problem on my first glance. I'd like to see what a real Android-developer thinks about these permissions though.
How did they even get the android.permission.INSTALL_PACKAGES permission approved on the play store? Google clearly states that: To use this permission, your app’s core functionality must include: Sending or receiving app packages, AND Enabling user-initiated installation of app packages. If your app does not meet the requirements for acceptable use below, you must remove it from your app's manifest in order to compl…
Hmmm.
> 2) We find the android.permission entries referenced in the proprietary parts of the decompiled source code, excluding occurrences in widely used and secure standard libraries by Android, Google, Facebook, PayPal and Klarna. Why would the proprietary source code reference these permissions, if it doesn’t have the option to use them in specific scenarios? Most importantly, many of these permissions in TEMU’s source code are not listed in their Android Manifest file, which is the standardized overview source for an app. For scrutinizing permission, the Android Manifest file is the first source to check permissions. Not mentioned in the Android manifest are the permission requests for CAMERA, RECORD_AUDIO, WRITE_EXTERNAL_STORAGE, INSTALL_PACKAGES, and ACCESS_FINE_LOCATION. It is not a coincidence that these permissions are the most intrusive ones when it comes to spying potential. For comparison, all the other apps listed in the cohort table enumerate all of these permissions in their Android Manifest, if they use them at all. The only exception is ACCESS_FINE_LOCATION by TikTok.
That's... not as strong of a link as I hoped this article would make.
So the code has references to INSTALL_PACKAGES. But doesn't seem to request it yet? Am I getting the argument from this post correctly?
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#36I suspected something like this, given how aggressive the marketing and ludicrous the claims have been.
Which is why I'm three times as suspicious of this site, which makes similarly ludicrous claims under the guise of malware research, like being able to DDoS a revealed MAC address. I am supposed to believe this article, whether or not it's true.
I understand the need to scattershot claims - if they just said 'TEMU has the ability to install packages onto your phone' then TEMU would issue some apology and release a new version that's sneakier about it.
But please, instead of smacking me in the face with a TOS/disclaimer that's supposed to ward off litigation over false/misleading claims, just don't publish false/misleading claims! Because that gives them the ammunition to say 'the stuff people are saying about TEMU is all lies'.
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#37> 1) Dynamic compilation using runtime.exec() "cmd package compile" doesn't compile source code at runtime. It forces ahead-of-time compilation of an application's existing bytecode, which is something which Android already does on an as-needed basis. I'm not sure why the Temu app would be running this command (performance, maybe?), but it isn't clearly dangerous either. https://source.android.com/docs/core/runtime/j…
> which is a unique and global hardcoded network identifier of a device
This is true.
> A Distributed Denial of Service (DDOS) attack and other unwanted security probes could conceivably be launched against a disclosed MAC address.
This is extremely painful for me to read. I don't even know how to describe how this is wrong.
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#38The analysis in this post, as others have pointed out, is quite poor. I still wouldn't install the app, especially after the Pinduoduo scandal earlier this year (which was well substantiated), but this isn't very good evidence.
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#39Why is everyone using this site? What's wrong with aliexpress?
Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
#40A bit off topic, but this website has some of the most draconian TOS I've ever seen > You agree that the information on this website is copyrighted, and you therefore agree not to distribute this information (whether the downloaded _le, copies / images / reproductions, or the link to these _les) in any manner other than by providing the following link: http://GRIZZLYREPORTS.COM So this HN submission is in violation o…
Couldn't even load the article on first try. Endless Cloudflare loop:
Ray ID: 8033126d6af60a48
In keeping with the TOS though, methinks.