3 ms·

I'd have to look into the app myself, but at first sight the permissions are scary but the decompiled code he showed was just about enough to show a map using B

I'd have to look into the app myself, but at first sight the permissions are scary but the decompiled code he showed was just about enough to show a map using Baidu maps. Probably just a feature of the app. I honestly think that yes they are probably collecting too many analytics for comfort, but at the same time it's really not that easy for a random app to really collect anything useful these days. All apps are sandboxed by definition, so all they're getting is what you give them. Also don't forget that high-accuracy location permission could also mean they just want to use Bluetooth for pairing something. I'm all for calling out espionage and malware. But I'd also like to see proof and not just "this could potentially be used for bad".

heroprotagonist 2y ago
I agree someone needs to look into this more directly. The bits he was specifically interested in and wrote most about were the thermography pieces. And that's where the focus of the article was. The author notes only skimming the parts he found where the requested permissions were used, given that the experience of the author was not focused in either Android nor Java. It's not a comprehensive analysis but what is there is very alarming. There is absolutely NO reason for this app to need MDM_APP_MGMT. This is capability for remote administration of the device, including ability to install additional apps (which is likely where this vector would expand exploitation). We don't see where that permission is used from the few screenshots of non-thermo sections. Same for a number of the other permissions. For an 'at-a-glance' review, compare this app's requested permissions to those requested by stalkerware in this stalkerware analysis and notice the similarities: https://andpalmier.com/posts/stalkerware-analysis/#analysis-of-the-sample https://andpalmier.com/posts/stalkerware-analysis/#analysis-...

heroprotagonist 2y ago

I agree someone needs to look into this more directly. The bits he was specifically interested in and wrote most about were the thermography pieces. And that's where the focus of the article was. The author notes only skimming the parts he found where the requested permissions were used, given that the experience of the author was not focused in either Android nor Java. It's not a comprehensive analysis but what is there is very alarming. There is absolutely NO reason for this app to need MDM_APP_MGMT. This is capability for remote administration of the device, including ability to install additional apps (which is likely where this vector would expand exploitation). We don't see where that permission is used from the few screenshots of non-thermo sections. Same for a number of the other permissions. For an 'at-a-glance' review, compare this app's requested permissions to those requested by stalkerware in this stalkerware analysis and notice the similarities: https://andpalmier.com/posts/stalkerware-analysis/#analysis-of-the-sample https://andpalmier.com/posts/stalkerware-analysis/#analysis-...