It would be good to do this kind of analysis on apps that have more than 10 million users - but in the mean time , has someone done this analysis on TicTok?
tl;dr it does aggressive device fingerprinting, root detection, has anti-tampering mechanisms, bundles native code and has dynamic code loading and execution facilities.<p>IMO, none of which should be necessary for an app like this<p>A dynamic analysis is still needed to confirm what it actually does.<p>I decided to do this after a researcher found obfuscated surveillance code in the web app
<a href="https://apnews.com/article/deepseek-china-generative-ai-internet-security-concerns-c52562f8c4760a81c4f76bc5fbdebad0" rel="nofollow">https://apnews.com/article/deepseek-china-generative-ai-inte...</a><p>NowSecure found similar not great runtime behavior in the iOS mobile app
<a href="https://www.nowsecure.com/press-releases/nowsecure-urges-enterprises-to-ban-the-deepseek-ios-mobile-app/" rel="nofollow">https://www.nowsecure.com/press-releases/nowsecure-urges-ent...</a>