Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

grizzlyreports.com

Post reply on HN
Print view View original

71–80 of 82 posts

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#71

Post by klik99 »

Jedd wrote: post #54
klik99 wrote: post #42

> TEMU is estimated ( Link ) to be losing $30 per order. Its ad spending and shipping costs (1-2 weeks from China, expedited to U.S. delivery) are astronomical. One is left wondering how this business could ever be profitable. This has literally been every startup in SV for the last 15 years - aggressively lose money aquiring users when new and then when you've killed the competition, start making money. The only thi…

> This has literally been every startup in SV for the last 15 years That is literally not true. > But I stand by my previous statement that literally nothing in this article is actual evidence I read the article. Some hand-wavey bits, yes, and some (probably) legal-cautious phrasing that you highlighted (eg the 'we believe' qualifier), but overall I find the evidence they've laid out to be highly compelling. What evi…

> That is literally not true.

Ok, I was exaggerating. Rather - It is either the dominant or one of the major strategies for VC funded SV companies at early stages. Aggressively lose money acquiring users. Even happens outside VC. The wired article linked in this article includes many good reasons why it's losing money: https://www.wired.com/story/temu-is-losing-millions-of-dolla...

Look, temu sounds scummy as hell - sounds like they can't compete in the Chinese market and trying to make a hail mary in the US market by being incredibly aggressive and using manipulative techniques.

> overall I find the evidence they've laid out to be highly compelling.

Have you ever worked on smartphone apps? There is nothing out of the ordinary, you can see that in the matrix of "security issues" - all other major apps use those things. The only thing that could be confusing is using the jit but temu includes games so it's probably a scripting language in those games. The jit isn't a security threat in itself - maybe an insecure language could run exploits, but there is not evidence of that happening. It can't create whole new programs with whole new permissions like this article implies.

> What evidence would you demand to concur that this is dangerous / spyware / a risk?

Anything out of the ordinary, other than a bunch of stuff that's normal plus big scary china. Specifically an example of it escalating access privileges would be a smoking gun.

Now - the fact that big companies have massive databases with names and addresses of people is a real issue. This is not unique to Temu or Chinese companies, and doesn't make Temu a spyware app.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#72

Post by Havoc »

gigofogfi wrote: post #50
Havoc wrote: post #10

Interesting. Recently ordered from them for giggles just because the pricing was crazy yet people seem to be getting their stuff. Even mentioned to a friend that something feels very off commercially here - like something is aggressively subsidised. Also Noticed that they were specifically pushing in app purchases hard with discounts etc. …but didn’t connect the dots between those two odd things.

"Is Temu Ethical? No, Temu is not an ethical brand. A U.S. Congressional Report from June 2023 raised alarming concerns about Temu and Shein’s potential links to forced labor. The report highlighted an “extremely high risk” of products on Temu being associated with forced labor, and the committee expressed particular worry about the exploitation of U.S. de minimis provisions by both companies. The de minimis threshol…

Ouch. Thanks for bringing that to my attention.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#73

Post by maxrecursion »

Havoc wrote: post #10

Interesting. Recently ordered from them for giggles just because the pricing was crazy yet people seem to be getting their stuff. Even mentioned to a friend that something feels very off commercially here - like something is aggressively subsidised. Also Noticed that they were specifically pushing in app purchases hard with discounts etc. …but didn’t connect the dots between those two odd things.

If something seems to good to be true it probably is. I agree with the people saying the article isn't the best, but TEMU selling products so cheap because the main product is the data taken from the customers phones who installed the app, makes more sense than this random company can sell products so cheaply, for reasons unknown.

Clearly China has been proven to be untrustworthy when it comes to their technology, apps included, so I tend to do the opposite of give them the benefit of the doubt, and just assume their apps are untrustworthy by default.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#74

Post by Jedd »

klik99 wrote: post #71
Jedd wrote: post #54

Earlier quoted context omitted.

> This has literally been every startup in SV for the last 15 years That is literally not true. > But I stand by my previous statement that literally nothing in this article is actual evidence I read the article. Some hand-wavey bits, yes, and some (probably) legal-cautious phrasing that you highlighted (eg the 'we believe' qualifier), but overall I find the evidence they've laid out to be highly compelling. What evi…

> That is literally not true. Ok, I was exaggerating. Rather - It is either the dominant or one of the major strategies for VC funded SV companies at early stages. Aggressively lose money acquiring users. Even happens outside VC. The wired article linked in this article includes many good reasons why it's losing money: https://www.wired.com/story/temu-is-losing-millions-of-dolla... Look, temu sounds scummy as hell -…

I haven't worked on smartphone apps.

But I'm looking at the matrix in TFA and the highlighted section for permissions -'lines 1, 4, 10, 15' - which are unique to this app, and wondering why an app that does what TEMU purports to do, needs all those.

Your claim 'all other major apps use those things' feels inaccurate, then, if that matrix is on the money - as those perms are exclusively used by them, albeit when compared only to the competitive apps they reference.

Sure, perhaps, as you say, a scripting language for games explains one of them. And a 'this unique permission is no big deal' may wave away another.

Anyway, that was just the first, but didn't feel like their major, point in making their argument.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#75

Post by klik99 »

Jedd wrote: post #74
klik99 wrote: post #71

Earlier quoted context omitted.

> That is literally not true. Ok, I was exaggerating. Rather - It is either the dominant or one of the major strategies for VC funded SV companies at early stages. Aggressively lose money acquiring users. Even happens outside VC. The wired article linked in this article includes many good reasons why it's losing money: https://www.wired.com/story/temu-is-losing-millions-of-dolla... Look, temu sounds scummy as hell -…

I haven't worked on smartphone apps. But I'm looking at the matrix in TFA and the highlighted section for permissions -'lines 1, 4, 10, 15' - which are unique to this app, and wondering why an app that does what TEMU purports to do, needs all those. Your claim 'all other major apps use those things' feels inaccurate, then, if that matrix is on the money - as those perms are exclusively used by them, albeit when compa…

Yeah I feel that matrix is misleading in a non-obvious way - it's selecting specific things that this app does all of (IE, mixing benign features in with things that are actual yellow flags, not including other yellow/red flags that the app doesn't do because you want it to look like Temu does ALL THE BAD THINGS), and selecting comparisons that paint it in a bad light (Temu has games embedded and the other apps don't, so comparing against popular game apps would show a different story - specifically on the permissions and inclusion of the JIT features) and then using red/green colors to make it seem scary, when none of these are smoking gun red flags.

Now that being said, I do think there is value in a bunch of yellow flags existing that hey maybe we should look into this more and I do think this is true about Temu - esp since another app has been taken down recently due to malware - though didn't take down Temu at the same time so presumably (strong but not 100% assumption) didn't find malware in it (look at that krebs on security article).

Temu seems really scummy, they use really morally bankrupt techniques borrowed from the worst in the games industry, and they are a good example of a larger problem of data collection, so I'm not defending them. But it's so easy to take these things that everyone is doing, add fear of china and then call it spyware, coming from an investment analyst company just sounds like a hit peace. It lowers the bar on real spyware, like Pegasus and Predator, that is actually being used by corrupt nation states to literally listen into conversations. Sure you can say that China can target locations of dissidents by requesting data from Temu, but they can do that without Temu. Even Private Investigators (read unlicensed non-state actors) in US have access to gray market cell phone data to target individuals, and hackers routinely breach sensitive data from companies that don't disclose leaks. There is a lot of real issues, and to take all that real concern and point it to TikTok and Temu isn't helping.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#77

Post by CatWChainsaw »

Calavar wrote: post #7

A bit off topic, but this website has some of the most draconian TOS I've ever seen > You agree that the information on this website is copyrighted, and you therefore agree not to distribute this information (whether the downloaded _le, copies / images / reproductions, or the link to these _les) in any manner other than by providing the following link: http://GRIZZLYREPORTS.COM So this HN submission is in violation o…

Maybe it's to deter content scraping.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#78

Post by CatWChainsaw »

diogenes4 wrote: post #51

Why is it only foreign software is fingered as malware? I have no doubt this is extraordinarily malicious software, but so was google ads, so was facebook, so were the app stores on our phones.

Come now, you know why.

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#79

Post by Jedd »

klik99 wrote: post #75
Jedd wrote: post #74

Earlier quoted context omitted.

I haven't worked on smartphone apps. But I'm looking at the matrix in TFA and the highlighted section for permissions -'lines 1, 4, 10, 15' - which are unique to this app, and wondering why an app that does what TEMU purports to do, needs all those. Your claim 'all other major apps use those things' feels inaccurate, then, if that matrix is on the money - as those perms are exclusively used by them, albeit when compa…

Yeah I feel that matrix is misleading in a non-obvious way - it's selecting specific things that this app does all of (IE, mixing benign features in with things that are actual yellow flags, not including other yellow/red flags that the app doesn't do because you want it to look like Temu does ALL THE BAD THINGS), and selecting comparisons that paint it in a bad light (Temu has games embedded and the other apps don't…

Yeah, okay, all fair points. I was sensitive to that matrix - despite not being au fait with all the nuances of the permission model in Android - likely being architected to look sinister by possibly cherry-picking the perms to highlight.

I've read enough explanations from developers I trust when responding to 'Why does your app need X...?' to know there are reasonable explanations in many cases.

OTOH, from someone familiar with generic OS permission models, a number of those are alarming enough to make me extremely wary of the app, especially in light of the parent corp's dubious business model.

I hadn't consciously registered the red / green colour choice, but definitely get your point there. I don't believe I'd gone straight to a 'china = bad' correlation, but also I'm sure my opinion is subtly influenced by the political and cultural implications (deltas in legal recourse, oversight, etc).

Re: TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.

#80

Post by ajross »

fuomag9 wrote: post #70
ajross wrote: post #29

Earlier quoted context omitted.

It doesn't get them via the play store, you can see the app permissions here (see "About this app ->", then under "Permissions" click "view details": https://play.google.com/store/apps/details?id=com.einnovatio...

I never said that it got them via the play store. If an application has that permission in the manifest it should get rejected by Google if they don’t conform to their use cases. They’re free to publish the APK themselves if they want tho

> I never said that it got them via the play store.

You literally asked "How did they even get the android.permission.INSTALL_PACKAGES permission approved on the play store?"

And I gave you a straightforward answer. I wasn't arguing with you, I was answering the question you posed.

Post reply on HN