Pinduoduo — According to cybersecurity experts, Pinduoduo, one of China’s most popular shopping apps, may snoop on users.

The program may be able to bypass mobile phone security in order to spy on other apps on the device.

In addition, the app can monitor notifications, change settings, and access private communications.

The app is tough to get rid of.

The investigation

Pinduoduo takes violations of privacy and data security to a new level.

Several programs collect massive amounts of user data without authorisation, but Pinduoduo takes it to a new level.

The crisis at the e-commerce behemoth was found by cybersecurity teams from Asia, Europe, and the United States, as well as former and current Pinduoduo employees.

Several researchers detected malware on the app that can attack vulnerabilities in Android operating systems.

Insiders said the vulnerabilities were used to promote sales by targeting customers and competitors.

According to Mikko Hyppönen, chief research officer of Finland’s WithSecure:

“We haven’t seen a mainstream app like this trying to escalate their privileges to gain access to things that they’re not supposed to gain access to.”

“This is highly unusual, and it is pretty damning for Pinduoduo.”

TikTok & security concerns

The finding of malware in Pinduoduo comes at a time when TikTok and data security are causing significant concern.

The revelations are anticipated to divert focus to its brother program, Temu, which is currently sweeping the United States.

Temu has not been mentioned, but Pinduoduo’s alleged activities may affect the growth of its sibling app.

So yet, no evidence of Pinduoduo sending data to the Chinese government has been discovered.

Yet, US lawmakers have raised concern about firms based in China being compelled to assist with security measures.

Initial suspension

Pinduoduo was withdrawn from the Google Play Store in March after malware was discovered in older versions of the app.

A Russian cybersecurity outfit identified possible malware as well, according to Bloomberg.

Earlier, the company refuted allegations and concerns that the software is dangerous.

Rise of an empire

Pinduoduo, while today well-known for its online shopping, had humble beginnings.

It was founded in 2015 in Shanghai by Colin Huang, a former Google employee.

The app began as an underdog in a market dominated by Alibaba and JD.com.

Pinduoduo was successful by giving steep discounts, encouraging group purchases from friends and family, and focusing on low-income rural regions.

According to financial records, the company thrived until around the middle of 2020, when monthly users dropped to around 50%, continuing a decreasing trend.

By 2020, the company had a team of 100 engineers and product managers looking for vulnerabilities in Android phones and flaws to exploit and profit from.

According to an anonymous insider, the company only targeted people in rural and small towns, avoiding major cities like Beijing and Shanghai.

“The goal was to reduce the risk of being exposed,” they explained.

The business was able to create a portrait of consumers’ actions and interests using user activity data.

According to the insider, the data also allowed the company to improve its machine-learning model, allowing it to give more personalized notifications and adverts.

In early March, suspicions regarding the squad’s actions led to its disbandment.

Read also: Galaxy S23 maintains consistency with minor changes

Findings

An independent assessment of the app’s 6.49.0 version was undertaken by Check Point Research, Oversecured, and WithSecure researchers.

When Google shut down Pinduoduo in March, it cited the detection of malware in off-Play versions as the reason.

Researchers identified privilege escalation malware, which attacks weak operating systems to get unauthorized access to data.

“Our team has reverse engineered that code and we can confirm that it tries to escalate rights, tries to gain access to things normal apps wouldn’t be able to do on Android phones,” said Hyppönen.

According to the corporation, the application may run in the background and prevent itself from being deleted, hence raising monthly active user rates.

Pinduoduo may spy on competitors by watching their activity and gathering data.

Check Point Research uncovered methods for the app to avoid detection.

It employed a mechanism that allowed it to post updates without being subjected to app store reviews, which are often used to discover malicious apps.

Many plug-ins hid potentially malicious components under legitimate file names.

“Such a technique is widely used by malware developers that inject malicious code into applications that have legitimate functionality,” said experts.

Targeting Android

The Android operating system is used by three-quarters of Chinese smartphone users, while Apple iPhones account for 25% of the market.

According to Oversecured inventor Sergey Toshin, Punduoduo’s malware is targeting Android-based operating systems, notably Samsung, Huawei, Xiaomi, and Oppo.

Toshin describes the app as a mainstream entity that harbors the most lethal malware.

“I’ve never seen anything like this before,” he said. “It’s like, super expansive.”

Toshin determined that the program took use of more than 50 Android system vulnerabilities, each of which was meant for customized parts.

Pinduoduo also exploited AOSP flaws, one of which he disclosed to Google in February 2022.

Yet, it was fixed by Google in March of this year.

The exploit gave the app access to the following without the user’s knowledge:

• Calendars
• Contacts
• Locations
• Notifications
• Photo albums

The malware may also change system settings, giving it access to users’ social media accounts and chats.

Law violation

Pinduoduo’s user base grew in the face of the Chinese government’s regulatory campaign on Big Tech, which began in late 2020.

By 2021, Beijing will have enacted its first comprehensive data privacy legislation, ensuring that no party inappropriately collects, manages, or transmits personal information.

“This would be embarrassing for the Ministry of Industry and Information Technology, because this is their job,” said Trivium China tech policy expert Kendra Schaefer.

“They’re supposed to check Pinduoduo, and the fact that they didn’t find (anything) is embarrassing for the regulator.”

Experts in cybersecurity wondered why regulators did not step in on Chinese social media.

“Probably none of our regulators can understand coding and programming, nor do they understand technology,” an expert wrote on Weibo.

“You can’t even understand the malicious code when it’s shoved right in front of your face.”