[dragontamer]

I'm not exactly an Android expert but... android.permission.INSTALL_PACKAGES, getRuntime.exec()... these basically are permissions for remote code execution, are they not?

I think this blogpost is hyperbolic in its discussion and that's a bit unhelpful. But this does look like a serious problem on my first glance. I'd like to see what a real Android-developer thinks about these permissions though.

[fuomag9]

How did they even get the android.permission.INSTALL_PACKAGES permission approved on the play store?

Google clearly states that:

To use this permission, your app’s core functionality must include:

Sending or receiving app packages, AND Enabling user-initiated installation of app packages. If your app does not meet the requirements for acceptable use below, you must remove it from your app's manifest in order to comply with Google Play policy. Suggestions for policy-compliant alternative implementations are also detailed below.

Which surely doesn’t seem the case for a shopping app?

[dragontamer]

Hmmm.

> 2) We find the android.permission entries referenced in the proprietary parts of the decompiled source code, excluding occurrences in widely used and secure standard libraries by Android, Google, Facebook, PayPal and Klarna. Why would the proprietary source code reference these permissions, if it doesn’t have the option to use them in specific scenarios? Most importantly, many of these permissions in TEMU’s source code are not listed in their Android Manifest file, which is the standardized overview source for an app. For scrutinizing permission, the Android Manifest file is the first source to check permissions. Not mentioned in the Android manifest are the permission requests for CAMERA, RECORD_AUDIO, WRITE_EXTERNAL_STORAGE, INSTALL_PACKAGES, and ACCESS_FINE_LOCATION. It is not a coincidence that these permissions are the most intrusive ones when it comes to spying potential. For comparison, all the other apps listed in the cohort table enumerate all of these permissions in their Android Manifest, if they use them at all. The only exception is ACCESS_FINE_LOCATION by TikTok.

That's... not as strong of a link as I hoped this article would make.

So the code has references to INSTALL_PACKAGES. But doesn't seem to request it yet? Am I getting the argument from this post correctly?

[ajross]

It doesn't get them via the play store, you can see the app permissions here (see "About this app ->", then under "Permissions" click "view details":

https://play.google.com/store/apps/details?id=com.einnovatio...

[fuomag9]

I never said that it got them via the play store. If an application has that permission in the manifest it should get rejected by Google if they don’t conform to their use cases.

They’re free to publish the APK themselves if they want tho

[ajross]

> I never said that it got them via the play store.

You literally asked "How did they even get the android.permission.INSTALL_PACKAGES permission approved on the play store?"

And I gave you a straightforward answer. I wasn't arguing with you, I was answering the question you posed.

[jasonjayr]

These permissions are not listed at https://play.google.com/store/apps/details?id=com.einnovatio... -- (Click the arrow next to "about this app, then view details under permissions) As someone who is not an App developers, Should they be listed there??

[oaktowner]

I did find the table comparing its permissions to others in the space...enlightening.

My kid bought something from Temu recently and it was ridiculously low-priced. I told him the quality must be terrible...and I was wrong. I was kind of shocked and wondered what the "catch" was.

Of course, I hadn't installed the app but wow, now I have the heebie-jeebies just thinking about it.

[JohnTHaller]

It's likely cheap because it's made with forced labor: https://apnews.com/article/temu-shein-forced-labor-china-de7...

[ars]

Temu doesn't make stuff, they sell stuff. They sell the exact same stuff you can get on aliexpress, Amazon, and WalMart.

If there's forced labor it's not specific to them, it's specific to China.

[oaktowner]

Ugh.

[tpmx]

You could send a postcard here with your thanks for the great deal:

    General Office of the Central Committee of the Chinese Communist Party
    West Building
    Zhongnanhai
    Beijing
    People's Republic of China

[joneholland]

It’s likely they use runtime exec because they are doing in app sideloading of features so they don’t need to wait for App Store approval. TEMU feels kinda like a superapp like wechat.

I think TEMU is a super shady company but I don’t think the app is the vector to worry about.