5 ms·
> but I remember reading that security researchers found the tiktok android binary had the capability to receive code remotely and execute it, This is a pretty
by tdeck 4y ago
> but I remember reading that security researchers found the tiktok android binary had the capability to receive code remotely and execute it,
This is a pretty normal thing in Android and a number of larger apps (and many games) use it to some extent as a way to modularize the application. An app can basically download dex files or other artifacts, load them, and execute them from within the app's process. While it's arguably not a good feature for the platform to have, this isn't necessarily some kind of diabolical hack.
The newer version of this is on-demand dynamic modules (which are hosted by Google), unfortunately I'm drawing a blank recalling what the older DIY version was called.
https://developer.android.com/codelabs/on-demand-dynamic-delivery#0 https://developer.android.com/codelabs/on-demand-dynamic-del...
- hsbauauvhabzb 4y agoDoes this permit out of band code execution, or does it require google or similar pre-cache any code to be executed? The latter is still a significant benefit over the former, as it guarantees non-targeted code deployment (at least if you trust the App Store) Edit: and revocation.
- tdeck 4y agoThe android platform lets you download code from anuwhere and sideliad it into your app (IIRX Unity can do this for you, for example). The thing I linked to does require you to upload to Play because I can't recall if there's a name for the DIY version. Either way if the app itself is pulled any code downloaded is running within the app, so it goes away too.