The article discusses the discovery of malware in Pinduoduo, a Chinese e-commerce company, and how regulators failed to detect it. The team of engineers and product managers who developed the exploits were disbanded after removing them from the app, but some core members remained at Pinduoduo.
Key points:
* Pinduoduo's app was found to contain malware that allowed for unauthorized access to users' personal data, including location, contacts, calendars, notifications, and photo albums.
* The malware was discovered in February by a Chinese cybersecurity firm called Dark Navy and later confirmed by other researchers.
* Despite the regulatory clampdown on Big Tech in China, Pinduoduo's apparent malware would have been a violation of the Personal Information Protection Law, which prohibits exploiting internet-related security vulnerabilities or engaging in actions that endanger cybersecurity.
* The Ministry of Industry and Information Technology and the Cyberspace Administration of China failed to take action against Pinduoduo, despite being aware of the issue.
* Some cybersecurity experts questioned why regulators haven't taken any action, citing a lack of understanding among regulators regarding coding, programming, and technology.
Implications:
* The failure of regulators to detect Pinduoduo's malware highlights a need for greater oversight and scrutiny of Chinese tech companies' data handling practices.
* The incident also underscores the importance of effective cybersecurity measures and responsible coding practices in preventing such breaches.
* The fact that some core team members remained at Pinduoduo after the exploits were removed suggests that the company may not have taken adequate steps to prevent similar incidents in the future.
Sources:
* Dark Navy
* Various researchers and experts (names mentioned include Kendra Schaefer, René Mayrhofer)
* Ministry of Industry and Information Technology
* Cyberspace Administration of China
Key points:
* Pinduoduo's app was found to contain malware that allowed for unauthorized access to users' personal data, including location, contacts, calendars, notifications, and photo albums.
* The malware was discovered in February by a Chinese cybersecurity firm called Dark Navy and later confirmed by other researchers.
* Despite the regulatory clampdown on Big Tech in China, Pinduoduo's apparent malware would have been a violation of the Personal Information Protection Law, which prohibits exploiting internet-related security vulnerabilities or engaging in actions that endanger cybersecurity.
* The Ministry of Industry and Information Technology and the Cyberspace Administration of China failed to take action against Pinduoduo, despite being aware of the issue.
* Some cybersecurity experts questioned why regulators haven't taken any action, citing a lack of understanding among regulators regarding coding, programming, and technology.
Implications:
* The failure of regulators to detect Pinduoduo's malware highlights a need for greater oversight and scrutiny of Chinese tech companies' data handling practices.
* The incident also underscores the importance of effective cybersecurity measures and responsible coding practices in preventing such breaches.
* The fact that some core team members remained at Pinduoduo after the exploits were removed suggests that the company may not have taken adequate steps to prevent similar incidents in the future.
Sources:
* Dark Navy
* Various researchers and experts (names mentioned include Kendra Schaefer, René Mayrhofer)
* Ministry of Industry and Information Technology
* Cyberspace Administration of China
I cant believe what's going on with Pinduoduo!!! They got malware in their app that was stealing users personal info like it was nothing!! 
And the craziest part is that the regulators knew about it but DIDNT DO ANYTHING ABOUT IT!!! 
Like, how can you not take action against a company thats putting peoples data at risk?!? 
I mean, I know there's been some controversy around Big Tech in China but this is just crazy! 
We need more oversight and better regulations to protect users, especially with all the sensitive info being shared online!! 
. I mean, it's not like they had a choice - the law is pretty clear on this stuff. And yet, nothing happened 
. It's almost like they wanted to let the company slide because of their size and influence in China 
. The fact that some core team members stayed on after the exploits were removed is super suspicious to me 
. I think it's a huge red flag for the company's commitment to security and user safety 
. We should be calling for even more scrutiny and accountability, not less 
.
. And what's even more disturbing is that the regulators just stood by and did nothing about it 
. I get it, they might not have known how coding works, but come on, this is basic stuff! 
. And let's hope that Pinduoduo takes this as a serious warning and makes some major changes to prevent something like this from happening again 
.
. Pinduoduo's malware is like, a huge deal 
It's all about taking responsibility for your actions... or in this case, your coding 
. I've been saying this for ages, more transparency needed in the tech industry. Can't have these Big Tech players doing whatever they want and getting away with it 
The Personal Information Protection Law is clear, yet nobody seems to be holding these companies accountable 
. We need stricter regulations and more oversight ASAP 
. It's also good to see that Dark Navy and other researchers are sounding the alarm about these issues 
. We just need to be proactive and work together to create a safer online world 
"! Can't believe the regulators in China didn't do their job right. They should've been more vigilant on that #cybersecurity matter. It's crazy to think that some core team members were allowed to stay after the exploits were removed - that's just not right, folks 
. Like, what's up with that? The fact that experts are questioning regulators' understanding of coding and tech is pretty telling too 
.
not a thing. They need to step up their game and start taking these things seriously. I mean, if you're gonna let malware run amok on one of the biggest e-commerce apps in China, what's next? 
. Next thing you know, they'll find malware on WeChat or whatever 
.
️.
It's not like they actually care about protecting user data or anything.
. And the regulators in China are sleepin' on the job? That's just not right 
. I mean, Kendra Schaefer and René Mayrhofer, these cybersecurity experts are like, "what are regulators doin', bro?" And the fact that some core team members stayed on at Pinduoduo... that's just a major red flag 