[yorwba]

> If you see their investigations and numbers, you probably think Pinduoduo is fine (really, take look the report)

That's... not the impression I got? Pinduoduo is called out as the app that uses the most Android permissions (all four tested); while many apps are found to access the clipboard, only Pinduoduo and Taobao upload the content, and unlike Taobao, Pinduoduo doesn't just do this during a product search but also when not using the app. It's not as bad as other apps on some aspects (Suning Yigou requesting location 1199 times in the background, really?) but doesn't exactly look fine either.

My guess is that CNCERT collected this information with a test harness that logged access to standard Android APIs and wasn't designed to detect exploits; they'll need to up their game next time.

[flangola7]

How can it access the clipboard?

[yorwba]

This StackOverflow question https://stackoverflow.com/questions/59903001/how-to-access-c... suggests that it was possible to read the clipboard in the background in Android versions before Q(10). Although it doesn't explicitly say how, maybe the example code given is how you'd do it.