Is Temu spying on your data?🕵️

Artur Stańczuk

July 7, 2024

•

min read

Share this post

Source

Summary:

Grizzly Research in Sep 2023 uncovered that the TEMU app, developed by Pinduoduo, includes spyware that exfiltrates extensive user data. With over 100M downloads in the U.S. and Europe, TEMU poses a serious security threat. PDD's financial transparency is also in question, heightening concerns. Recently Arkansas AG sued Temu, claiming it uses app to steal user data and poses a major security risk.

Deep Dive:

🛡️ Security Threat Uncovered

Grizzly Research released a report on September 6, 2023, alleging that the TEMU app, developed by Pinduoduo (PDD), functions as spyware. According to security experts, the app has hidden features that allow it to steal extensive user data, including location, camera access, and personal files. The app, which has been downloaded over 100 million times in the last 9 months, poses a significant threat to user privacy. “TEMU’s software can locally compile malicious code, making it difficult to detect,” says Mikko Hyppönen, a cybersecurity expert. Despite these risks, TEMU continues to operate widely in the U.S. and Europe.

🛡️ Arkansas AG Takes Legal Action

Arkansas Attorney General Tim Griffin is suing Temu and its parent company, PDD Holdings. Griffin announced the lawsuit on June 28, 2024, accusing Temu of using "deceptive tactics" to harm consumers. He claims Temu is "a data theft company" rather than just an online marketplace. Temu, the western arm of Chinese retail giant Pinduoduo, offers users credits for purchases through mini-games or referrals. Griffin's lawsuit is based on a forensic investigation by Grizzly Research, which calls PDD Holdings "fraudulent" and claims Temu contains hidden spyware.

🔍 Malware and Data Collection Accusations

Griffin alleges Temu's app contains dangerous malware accessing virtually all data on users' phones. The lawsuit cites Google and Apple's temporary removal of Temu and Pinduoduo apps for similar reasons. According to Griffin, Temu collects excessive data beyond what's needed for a shopping app, including camera, location, and contact information. This unauthorized data collection is allegedly monetized, posing privacy risks to users.

🗨️ Temu's Response to Allegations

Temu spokesperson has reached out to me with a comment: "We are surprised and disappointed by the Arkansas Attorney General's Office for filing the lawsuit without any independent fact-finding. The allegations in the lawsuit are based on misinformation circulated online, primarily from a short-seller, and are totally unfounded. We categorically deny the allegations and will vigorously defend ourselves." More information can be found in Bloomberg article

‍

Do you trust Temu with your data?