18 ms·
TEMU Is Cleverly Hidden Spyware That Poses an Urgent Security Threat to U.S.
- joneholland 3y agoThis is some kind of Walmart version of Hindenburg research. Even copying their website style. Are they short PDD? Tough choice considering china stocks are so manipulated you’ll go broke before the truth is revealed.
- rado 3y agohttps://www.joom.com/ https://www.joom.com/ has such great design and UX that I had to try it and it worked great (about 5 orders)
- actuallyrizzn 3y agoWeird tos. I'm not clicking agree on that.
- carlotte 3y ago[dead]
- daft_pink 3y agoIs it me or is this an over the top not very trust worthy article designed to move the stock market?
- joneholland 3y agoYeah. This is a short seller report.
- ryandamm 3y agoIt's a market research firm, probably also a hedge fund that takes a short position specifically before posting these articles to make money on a short position. (See also Muddy Waters (https://www.muddywatersresearch.com/ https://www.muddywatersresearch.com/). So yes, it's designed to move the stock market. That doesn't mean it's wrong, though.
- daft_pink 3y agoObviously Temu is losing money to gain a foothold in the United States. I don't think anyone would dispute that and obviously they are a Chinese company and all large Chinese companies have ties to the Gov't. Claims that it is spyware seem really over the top though.
- deleted 3y ago[deleted]
- dragontamer 3y agoI'm not exactly an Android expert but... android.permission.INSTALL_PACKAGES, getRuntime.exec()... these basically are permissions for remote code execution, are they not? I think this blogpost is hyperbolic in its discussion and that's a bit unhelpful. But this does look like a serious problem on my first glance. I'd like to see what a real Android-developer thinks about these permissions though.
- oaktowner 3y agoI did find the table comparing its permissions to others in the space...enlightening. My kid bought something from Temu recently and it was ridiculously low-priced. I told him the quality must be terrible...and I was wrong. I was kind of shocked and wondered what the "catch" was. Of course, I hadn't installed the app but wow, now I have the heebie-jeebies just thinking about it.
- JohnTHaller 3y agoIt's likely cheap because it's made with forced labor: https://apnews.com/article/temu-shein-forced-labor-china-de7b5398c76fda58404abc6ec5684972 https://apnews.com/article/temu-shein-forced-labor-china-de7...
- tpmx 3y agoYou could send a postcard here with your thanks for the great deal: General Office of the Central Committee of the Chinese Communist Party West Building Zhongnanhai Beijing People's Republic of China
- Calavar 3y agoA bit off topic, but this website has some of the most draconian TOS I've ever seen > You agree that the information on this website is copyrighted, and you therefore agree not to distribute this information (whether the downloaded _le, copies / images / reproductions, or the link to these _les) in any manner other than by providing the following link: http://GRIZZLYREPORTS.COM http://GRIZZLYREPORTS.COM So this HN submission is in violation of their (probably unenforceable) TOS just by virtue of linking to a path other than the root path of the domain. > If you have obtained research published by Grizzly Research LLC in any manner other than by download from that link, you may not read such research without going to that link and agreeing to the Terms of Use on the Grizzly Research LLC designated website. Quite ridiculous to expect that you can enforce a directive (don't read this article) on someone who hasn't visited your site and is therefore probably unaware that your TOS even exist.
- CatWChainsaw 3y agoMaybe it's to deter content scraping.
- fuomag9 3y agoAnd also the button for not accepting it does nothing lol
- smegsicle 3y agoused to link to drudge report before he sold it
- nonethewiser 3y agoThe button to decline the TOS is also not a button. It does nothing.
- Animats 3y agoThat's a Securities and Exchange Commission compliance thing. Grizzly advises investors for pay, and they have to disclose that they do so. Companies on their list are quite likely to sue them. And lose.
- 3y ago
- Havoc 3y agoInteresting. Recently ordered from them for giggles just because the pricing was crazy yet people seem to be getting their stuff. Even mentioned to a friend that something feels very off commercially here - like something is aggressively subsidised. Also Noticed that they were specifically pushing in app purchases hard with discounts etc. …but didn’t connect the dots between those two odd things.
- maxrecursion 3y agoIf something seems to good to be true it probably is. I agree with the people saying the article isn't the best, but TEMU selling products so cheap because the main product is the data taken from the customers phones who installed the app, makes more sense than this random company can sell products so cheaply, for reasons unknown. Clearly China has been proven to be untrustworthy when it comes to their technology, apps included, so I tend to do the opposite of give them the benefit of the doubt, and just assume their apps are untrustworthy by default.
- czDRZ-akk 3y agoThe only thing that Temu subsidizes is shipping, the pricing itself is normal. Temu is essentially a window for US consumers to see what the average Chinese consumer is used to. You can directly compare products and prices between Taobao and Temu; the pricing is similar, with Temu typically being a bit more expensive even with discounts. Even with shipping, it’s unclear exactly how much Temu would actually be losing per order depending on how efficient their distribution network is.
- gigofogfi 3y ago"Is Temu Ethical? No, Temu is not an ethical brand. A U.S. Congressional Report from June 2023 raised alarming concerns about Temu and Shein’s potential links to forced labor. The report highlighted an “extremely high risk” of products on Temu being associated with forced labor, and the committee expressed particular worry about the exploitation of U.S. de minimis provisions by both companies. The de minimis threshold of $800 allows goods below this value to enter the country without inspection, which could contribute to potential issues with labor practices. Furthermore, the report revealed that Temu lacks a specific policy against goods made in Xinjiang, where evidence suggests forced labor may occur." https://yoursustainableguide.com/is-temu-ethical/ https://yoursustainableguide.com/is-temu-ethical/
- alsdkjasldkj 3y agoA long writeup but very few facts: > TEMU is estimated ( Link ) to be losing $30 per order. Its ad spending and shipping costs (1-2 weeks from China, expedited to U.S. delivery) are astronomical. One is left wondering how this business could ever be profitable. > TEMU is a notoriously bad actor in its industry. We see rampant user manipulation, chain-letter-like affinity scams to drive signups, and overall, the most aggressive and questionable techniques to manipulate large numbers of people to install the app. > TEMU is demonstrably more dangerous than TikTok. The app should be removed from the Google and Apple app stores. Grizzly Reports (https://twitter.com/ResearchGrizzly https://twitter.com/ResearchGrizzly) is "focused on producing differentiated research insights on publicly traded companies through in-depth due diligence." This seems like low quality junk to me.
- ClumsyPilot 3y ago> aggressive and questionable techniques to manipulate large numbers of people to install the app. So basically like facebook?
- kcb 3y agoExcept all the ones after those first couple of bullet points...
- radicaldreamer 3y agoMany Direct-to-Consumer companies have the exact same model, get you hooked on the app and then raise prices.
- duskwuff 3y agoOffering discounts to first-time customers is a fairly common sort of growth hacking. If Temu were a US company, we wouldn't even be batting an eye at it.
- meowtimemania 3y agoWhy would temu try be spyware any more than google is spyware? I feel like doing something abnormally super sketchy is too high risk for them given how much stuff they sell and how much money they on their brand.
- animitronix 3y agoUmm, BECAUSE CHINA. FFS
- modeless 3y agoSurprisingly, for almost all the things that I've bothered to compare, Amazon is actually cheaper than Temu. Even cheap toys from China that I thought would be Temu's bread and butter. And of course the shipping is no contest. The deals look good in their app but try searching for the same item on Amazon and I bet you will be surprised. Temu sometimes gives you more flexibility to order a single copy of small items while Amazon might only have bundles. But then Temu has a minimum order size you must meet while Amazon doesn't. So I haven't found any reason to use Temu after their ridiculous free money coupon for new users is gone.
- Chiba-City 3y ago[dead]
- kylehotchkiss 3y agoScariest thing here is the `write_external_storage`. Is this just going to install trojan horse things onto SD cards/memory sticks? The time is coming for Apple to support iCloud private relay for all 3rd party apps. Ideally nothing is leaving the phone without it shortly.
- eternityforest 3y agoSounds kinda awful, what if the relay goes down at an important time? You just know they're going to do something like banning LAN connections too unless it's on some special whitelist so nobody can ever make a true P2P app.
- deleted 3y ago[deleted]
- duskwuff 3y ago> 1) Dynamic compilation using runtime.exec() "cmd package compile" doesn't compile source code at runtime. It forces ahead-of-time compilation of an application's existing bytecode, which is something which Android already does on an as-needed basis. I'm not sure why the Temu app would be running this command (performance, maybe?), but it isn't clearly dangerous either. https://source.android.com/docs/core/runtime/jit-compiler https://source.android.com/docs/core/runtime/jit-compiler The rest of the analysis doesn't seem much better, e.g. > 3) TEMU queries information related to files, and not just its own files, but wants information on all files on the user’s device by referencing “EXTERNAL_STORAGE”, superuser rights and log files. The EXTERNAL_STORAGE permission is literally just external storage, like the name implies. It doesn't grant access to files in internal storage, like other applications' data or system logs. > 5) “Root” access. TEMU checks if a device has “root” access. Yes, this is fairly common. (And indeed, the table at the top of the report notes that most of the other shopping apps they analyzed did this.) > 6) Encryption, decryption and shifting integer signals libraries are in prior versions of Pinduoduo and TEMU apps. The only purpose of this is obscuration of malicious intent. I'm not even sure what they're trying to suggest by this. Are they actually assuming that any use of bit-shifting operators is malicious? > 10) [...] The TEMU app even reads and stores the MAC address, which is a unique and global hardcoded network identifier of a device. This is a big No No in internet security. A Distributed Denial of Service (DDOS) attack and other unwanted security probes could conceivably be launched against a disclosed MAC address. This is complete nonsense. MAC addresses don't work like that. > 11) Looking over your shoulder while you use your smartphone. TEMU calls getWindow().getDecorView().getRootView(), to make screenshots That only captures the appearance of the Temu application, not other applications on the system.
- dragontamer 3y ago> which is a unique and global hardcoded network identifier of a device This is true. > A Distributed Denial of Service (DDOS) attack and other unwanted security probes could conceivably be launched against a disclosed MAC address. This is extremely painful for me to read. I don't even know how to describe how this is wrong.
- 3y ago
- nonethewiser 3y agoWeird website aside, I would not at all be surprised that TEMU is spyware.
- winrid 3y agoIts interesting that the Amazon app requests more questionable permissions than TikTok
- nonethewiser 3y agoAs I said in another comment, I would not be surprised if TEMU is spyware. This website is questionable and I could really only find this other source or ones like it: https://www.usatoday.com/story/tech/columnist/komando/2023/04/20/delete-temu-app-cybersecurity-expert-advice/11667796002/ https://www.usatoday.com/story/tech/columnist/komando/2023/0... Still light on details and Im not sure who this Komanda person is but there is some real appeal to authority going on and no hard evidence of the claims. Again, I would not be surprised if it was spyware and it seems wise to be suspicious. Hopefully we get more information.
- pie_flavor 3y agoI suspected something like this, given how aggressive the marketing and ludicrous the claims have been. Which is why I'm three times as suspicious of this site, which makes similarly ludicrous claims under the guise of malware research, like being able to DDoS a revealed MAC address. I am supposed to believe this article, whether or not it's true. I understand the need to scattershot claims - if they just said 'TEMU has the ability to install packages onto your phone' then TEMU would issue some apology and release a new version that's sneakier about it. But please, instead of smacking me in the face with a TOS/disclaimer that's supposed to ward off litigation over false/misleading claims, just don't publish false/misleading claims! Because that gives them the ammunition to say 'the stuff people are saying about TEMU is all lies'.
- saagarjha 3y agoThe analysis in this post, as others have pointed out, is quite poor. I still wouldn't install the app, especially after the Pinduoduo scandal earlier this year (which was well substantiated), but this isn't very good evidence.
- ThrowawayTestr 3y agoWhy is everyone using this site? What's wrong with aliexpress?
- AussieWog93 3y agoSome AliExpress orders arrive slower. Also Temu are throwing money at customer acquisition. My wife got something like 90% off her first order.
- daft_pink 3y agoThe issues around AliExpress are essentially related to shipping. It takes too long and they don’t enforce the delivery times and the seller can send you the wrong thing or if you want to return it you get to pay the return shipping back to China. You have to understand that 7 day delivery means it might show up in a few months and only buy from high quality sellers. That’s why it has such a bad reputation.
- klik99 3y ago> TEMU is estimated ( Link ) to be losing $30 per order. Its ad spending and shipping costs (1-2 weeks from China, expedited to U.S. delivery) are astronomical. One is left wondering how this business could ever be profitable. This has literally been every startup in SV for the last 15 years - aggressively lose money aquiring users when new and then when you've killed the competition, start making money. The only thing is I don't see any external funding, so maybe they're doing it with hidden funding or a stockpile from PDD? This feels like a lot of weak sauce, from the weird combo of clickbait title with CYA "We Believe", throwing a bunch of weak evidence all at once, overwhelming you into accepting the premise. If you have "smoking gun" evidence like they claim, then you wouldn't need to hedge your statement with "We believe". And this is a investment research company, not a security company. I'd sooner believe a pillow salesman ranting about the deep state than this. ~Edit~ Counterpoint: looks like their other main product Pinduoduo was removed from Google Play due to malware, so it could actually be true. https://krebsonsecurity.com/2023/03/google-suspends-chinese-e-commerce-app-pinduoduo-over-malware/ https://krebsonsecurity.com/2023/03/google-suspends-chinese-... But I stand by my previous statement that literally nothing in this article is actual evidence, so if does turn out to be true it's a coincidence.
- pxue 3y agoThis is chinese government subsidizing youth unemployment. My 60yo mother gets messaged every day on wechat from young Chinese ppl asking her to buy stuff on temu, they're all unemployed otherwise.
- Jedd 3y ago> This has literally been every startup in SV for the last 15 years That is literally not true. > But I stand by my previous statement that literally nothing in this article is actual evidence I read the article. Some hand-wavey bits, yes, and some (probably) legal-cautious phrasing that you highlighted (eg the 'we believe' qualifier), but overall I find the evidence they've laid out to be highly compelling. What evidence would you demand to concur that this is dangerous / spyware / a risk?
- deleted 3y ago[deleted]
- croes 3y ago>IMPORTANT LEGAL DISCLAIMER THIS REPORT AND ALL STATEMENTS CONTAINED HEREIN ARE THE OPINIONS OF GRIZZLY RESEARCH LLC AND ARE NOT STATEMENTS OF FACT.
- diogenes4 3y agoWhy is it only foreign software is fingered as malware? I have no doubt this is extraordinarily malicious software, but so was google ads, so was facebook, so were the app stores on our phones.
- CatWChainsaw 3y agoCome now, you know why.
- aaron695 3y ago[dead]
- sharkweek 3y agoA few thoughts. I’d honestly estimate 20% of the ads I see on websites now are TEMU. I’ve never clicked on one, and will never sign up. If they stop advertising the ad market will feel the waves. The products being advertised to me are WILDLY irrelevant. It feels like they’re just shooting a shotgun into the air. It looks like they’re selling only the cheapest stuff, like cutting the middleperson of the FIVE CAPITAL LETTER brand names that use Amazon Marketplace. As much as I don’t trust a plunger or measuring cup from HYYNA, I trust TEMU quality even less.
- mickelsen 3y agoWhat are the oh-so-deep discounts you guys see, that could justify that $30 figure. I mean, I'm seeing the same stuff from Aliexpress, at about the same price, with free shipping. Just another chinese marketplace like banggood, dhgate, etc. Or am I missing some crazy subsidy because I'm not from the US?