TikTok Ban Bill Is Patriot Act 2.0 Trojan Horse

Re:TikTok Ban Bill Is Patriot Act 2.0 Trojan Horse by tdeck on Thursday March 30, 2023 @01:40AM (#35368526)

> but I remember reading that security researchers found the tiktok android binary had the capability to receive code remotely and execute it,

This is a pretty normal thing in Android and a number of larger apps (and many games) use it to some extent as a way to modularize the application. An app can basically download dex files or other artifacts, load them, and execute them from within the app's process. While it's arguably not a good feature for the platform to have, this isn't necessarily some kind of diabolical hack.

The newer version of this is on-demand dynamic modules (which are hosted by Google), unfortunately I'm drawing a blank recalling what the older DIY version was called.

https://developer.android.com/codelabs/on-demand-dynamic-del...

[ Parent | on HN ]

Re:TikTok Ban Bill Is Patriot Act 2.0 Trojan Horse by hsbauauvhabzb on Thursday March 30, 2023 @01:51AM (#35368598)

Does this permit out of band code execution, or does it require google or similar pre-cache any code to be executed? The latter is still a significant benefit over the former, as it guarantees non-targeted code deployment (at least if you trust the App Store)

Edit: and revocation.

[ Parent | on HN ]

Re:TikTok Ban Bill Is Patriot Act 2.0 Trojan Horse by tdeck on Thursday March 30, 2023 @04:22AM (#35369634)

The android platform lets you download code from anuwhere and sideliad it into your app (IIRX Unity can do this for you, for example). The thing I linked to does require you to upload to Play because I can't recall if there's a name for the DIY version.

Either way if the app itself is pulled any code downloaded is running within the app, so it goes away too.

[ Parent | on HN ]