The article discusses the discovery of malware in Pinduoduo's mobile app, which allows access to users' sensitive information without their consent. The malware was discovered by a Chinese cybersecurity firm called Dark Navy and later confirmed by other researchers.
**Key points:**
* The malware was found to be exploiting vulnerabilities in Android apps, allowing the app to request excessive permissions from users.
* Pinduoduo's app was specifically found to be requesting "set wallpaper" and "download without notification" permissions, which are considered invasive.
* The malware also allowed access to users' locations, contacts, calendars, notifications, and photo albums.
* The exploit code was removed after an update of the app, but tech experts warn that the underlying code could still be reactivated.
* Pinduoduo has been criticized for its lack of oversight and regulatory compliance.
**Regulatory context:**
* China's Ministry of Industry and Information Technology has regularly published lists of apps that have undermined user privacy or other rights.
* However, Pinduoduo did not appear on any of the lists.
* The Chinese government's data privacy legislation prohibits exploiting internet-related security vulnerabilities or engaging in actions that endanger cybersecurity.
**Consequences:**
* Users who installed the app may be at risk of their sensitive information being accessed without consent.
* The discovery highlights a lack of regulatory oversight and enforcement in China's tech industry.
* Pinduoduo has faced criticism for its handling of the issue, including the removal of the exploit code and the transfer of affected employees to other departments.
**Key points:**
* The malware was found to be exploiting vulnerabilities in Android apps, allowing the app to request excessive permissions from users.
* Pinduoduo's app was specifically found to be requesting "set wallpaper" and "download without notification" permissions, which are considered invasive.
* The malware also allowed access to users' locations, contacts, calendars, notifications, and photo albums.
* The exploit code was removed after an update of the app, but tech experts warn that the underlying code could still be reactivated.
* Pinduoduo has been criticized for its lack of oversight and regulatory compliance.
**Regulatory context:**
* China's Ministry of Industry and Information Technology has regularly published lists of apps that have undermined user privacy or other rights.
* However, Pinduoduo did not appear on any of the lists.
* The Chinese government's data privacy legislation prohibits exploiting internet-related security vulnerabilities or engaging in actions that endanger cybersecurity.
**Consequences:**
* Users who installed the app may be at risk of their sensitive information being accessed without consent.
* The discovery highlights a lack of regulatory oversight and enforcement in China's tech industry.
* Pinduoduo has faced criticism for its handling of the issue, including the removal of the exploit code and the transfer of affected employees to other departments.
they found malware in their app that can access users' sensitive info without them even knowing it's happening... like, no one wants their location, contacts, or photos shared w/o consent 
. 
I mean, the gov's data privacy legislation is super strict but apparently Pinduoduo didn't follow it... that's just bad practice 
.
. And now they're facing criticism for how they handled it, like removing the exploit code & transferring affected employees to other departments... sounds like they're trying to sweep it under the rug 
.
. We need more transparency & accountability, you feel? 
.
. And yeah, Pinduoduo getting away with this without being on any list of naughty apps just shows how lax the oversight is.
.
their lack of oversight and regulatory compliance is just a big red flag, dont even get me started on the fact that users could access their sensitive info without consent 
I mean, i no chinese laws r strict about cyber security but its still super shady that pinduoduo didnt even get caught earlier! 
did u guys hear they removed the code? idk if thats a good enough solution tho. like, what if it comes back? 
we need better regulations n stuff so this doesnt happen again 
it's all about the benjamins honey 
but seriously though, our data is like gold 
and we gotta be careful about who gets to control it 
this is so disappointing 
. The fact that their app was exploiting vulnerabilities in Android apps and asking for super invasive permissions is just wild 
... it's like, what were they thinking? 
. Like, they should totally give more control back to users and make sure that their app is doing everything possible to keep people's info safe 
... fingers crossed! 
. Remember how we were all worried about our privacy online? Yeah, it seems like not much has changed. Pinduoduo's got some serious 'splainin' to do for allowing this malware in their app 
It's like they're trying to make us feel like we're living in a sci-fi movie or something 
. Anyway, hope everyone affected by this gets their sensitive info secured ASAP 
.
.
. They should be doing more to protect users' info, not just relying on "oh no, we'll fix it" type responses 
. I mean, I've been seeing these "set wallpaper" and "download without notification" permissions popping up on my friends' phones for ages, and we were all just like "huh, why do they need that?" 
.
. It's not exactly rocket science, right? 
. I mean, think about it - they're asking for way too many permissions, like setting your wallpaper or downloading stuff without even telling you 
what kinda company does that? 
the chinese gov should really step up their game when it comes to regulating these kinds of things 
. I'm also worried about all the people who did install the app and their info might've been compromised 
I'm really worried about this news on Pinduoduo's malware issue... It's like, how did this even happen? 
The malware was also accessing sensitive user info like location, contacts, calendars, and photo albums. I mean, what's the point of that? It's like a bad movie script - "Hey, let's add some drama by hacking into users' private lives!" 
. this is why we need stronger data protection laws and more transparency in the tech industry 
Like, do you really need access to my location and photos just to buy some stuff? "Hey, can I come over too?" No thanks! 