As working professionals, we rely on our smartphones and apps for various tasks. From shopping to communication, we trust these apps with our personal information. But what if one of the most popular apps you use daily is hiding a dark secret?
A Dangerous Discovery
In March 2023, researchers confirmed malicious functionality in certain versions of Pinduoduo's Android shopping app distributed outside Google Play. This was a mainstream service: Pinduoduo had reported 751.3 million average monthly active users in the first quarter of 2022. That historical audience figure should not be read as the number of people affected by the malware.
Lookout's analysis confirmed malicious functionality in off-Play Android versions and found that they were signed with the same signing key as the app distributed through Google Play. Its guidance described capabilities including spying on users, preventing removal, installing additional malware in the background and removing other applications. These findings concern the versions investigated in 2023, not a determination that every version of Pinduoduo, or its current release, contains malware.
How Pinduoduo Exploited Android Vulnerabilities
The analyzed malware targeted Android. Lookout identified exploitation of CVE-2023-20963, a vulnerability that could allow an app to gain elevated privileges. Google's March 2023 Android Security Bulletin included a fix and noted indications of limited, targeted exploitation. Google Project Zero identifies the first patched security level as March 1, 2023. This is a historical patch milestone, not a recommendation to stop updating at that level.
The Consequences
Google suspended Pinduoduo from Google Play in March 2023. Lookout's contemporaneous guidance documented the Play Store removal and confirmed malicious functionality in versions distributed outside Google Play. The distinction matters: the suspension should not be treated as proof that the Google Play version itself contained the analyzed malware.
In our view, the presence of such intrusive functionality in versions of a mainstream shopping app raised serious concerns about data security and privacy.
Key Takeaways and Action Steps
- Be cautious when downloading and using apps, even from reputable sources. Research the app and its developer before installation, and do not ignore security warnings.
- Regularly update your phone and apps to the latest available versions, which may contain security patches and fixes. On Android, check your operating-system, security-update and Google Play system-update status using Google's update guidance.
- Be mindful of the permissions you grant to apps. Only give necessary permissions that align with the app's purpose. Google's Android permissions guidance explains how to review and change them.
- If your Android device has Google Play, keep Google Play Protect enabled. Open the Play Store, tap your profile icon, then Play Protect, then Settings, and make sure Scan apps with Play Protect is on. If it flags an app as harmful, follow the uninstall prompt. Google explains that Play Protect checks apps from Google Play and other sources.
- Stay informed about cybersecurity news and developments to better protect yourself and your data.
The Pinduoduo case is a stark reminder that even popular and seemingly trustworthy apps can pose significant risks to our data and privacy.