PoliticăAfganistan

CPI emite mandate de arestare pentru liderii talibani

John Silk AP, AFP, Reuters, dpa07/09/20259 iulie 2025

Curtea ONU a declarat că talibanii au „privat grav fetele și femeile de dreptul la educație, intimitate și viață de familie și de libertatea de mișcare, exprimare, gândire, conștiință și religie”.

https://p.dw.com/p/4xAEDPotrivit ONU, aproape 80% dintre femeile sub 30 de ani sunt excluse de la educație sau de la muncă în AfganistanImagine: Peter Dejong/AP/dpa/picture alianță

Curtea Penală Internațională (CPI) a emis marți mandate de arestare pe numele liderului suprem și președintelui Curții Supreme a talibanilor, acuzându-i de persecutarea fetelor și femeilor în Afganistan.

CPI a declarat că există motive să creadă că liderul spiritual suprem Haibatullah Akhundzada și Abdul Hakim Haqqani, președintele Curții Supreme a talibanilor, au comis crima împotriva umanității de persecuție pe motive de gen împotriva fetelor, femeilor și „altor persoane care nu se conformează” politicii talibanilor privind genul, identitatea de gen sau exprimarea genului, se arată într-un comunicat al curții ONU.

„Deși talibanii au impus anumite reguli și interdicții populației în ansamblu, aceștia au vizat în mod specific fetele și femeile din cauza genului lor, privându-le de drepturi și libertăți fundamentale”, a continuat declarația.

Talibanii au „privat grav” fetele și femeile de dreptul la educație, intimitate și viață de familie și de libertatea de mișcare, exprimare, gândire, conștiință și religie, au declarat judecătorii CPI.

„În plus, alte persoane au fost vizate deoarece anumite expresii ale sexualității și/sau identității de gen au fost considerate incompatibile cu politica talibanilor privind genul.”

Afganistan: Femeile devin «invizibile» sub talibani

Pentru a viziona acest videoclip, vă rugăm să activați JavaScript și să luați în considerare actualizarea la un browser web care acceptă videoclipuri HTML5

Care a fost răspunsul talibanilor?

Tribunalul cu sediul la Haga a susținut că crimele au avut loc începând cu 15 august 2021, când talibanii au preluat puterea, și au durat cel puțin până pe 20 ianuarie 2025.

Talibanii au respins mandatele de arestare ca fiind „prostii” și că decizia CPI „nu va afecta angajamentul și dedicarea puternică față de sharia (legea islamică)”, a declarat purtătorul de cuvânt Zabihullah Mujahid a declarat într-un comunicat.

Restricțiile talibane obligă femeile să studieze medicina în străinătate

Pentru a viziona acest videoclip, vă rugăm să activați JavaScript și să luați în considerare actualizarea la un browser web care acceptă videoclipuri HTML5

Urmărește cele mai importante știri

Care este scopul CPI?

CPI a fost creată pentru a judeca cele mai grave crime din lume, cum ar fi crimele de război și crimele împotriva umanității. Curtea nu are o forță de poliție proprie și se bazează pe statele membre pentru a executa mandatele de arestare.

În teorie, aceasta înseamnă că orice persoană care face obiectul unui mandat de arestare CPI nu poate călători într-un stat membru de teama de a fi reținută. În practică, acest lucru nu a fost întotdeauna așa.

De la revenirea la putere acum patru ani, talibanii au impus măsuri care includ interzicerea accesului femeilor în locurile publice și interzicerea fetelor de a merge la școală după clasa a șasea.

Săptămâna trecută, Rusia a devenit prima țară care a recunoscut oficial regimul taliban.

Rusia recunoaște guvernul taliban din Afganistan

Pentru a viziona acest videoclip, vă rugăm să activați JavaScript și să luați în considerare actualizarea la un browser web care acceptă videoclipuri HTML5

În ultimii ani, CPI a solicitat, de asemenea, arestarea președintelui rus Vladimir Putin și a prim-ministrului israelian Benjamin Netanyahu.

Editat de: Saim Dušan Inayatullah

John Silk Redactor și scriitor pentru știri în limba engleză, precum și pentru Birourile de Cultură și Asia.@JSilkTrimiteți-ne feedback-ul dvs.

Sursa: DW

Colaboratoarea politică CNN Maggie Haberman explică raționamentul din spatele atacurilor lui Donald Trump asupra judecătorului și a familiei sale în timpul unui discurs la stațiunea sa din Mar-a-Lago, după ce a fost pus sub acuzare pentru infracțiuni grave.

Sursa: CNN

Sursa: CNN

Oamenii de știință au capturat specia necunoscută de pește-melc la o adâncime de peste 27.000 de picioare, ca parte a unei expediții în tranșee în largul coastei Japoniei.

Sursa: CNN

00:55 – Source: CNN World News 16 videos 00:55 Now playing – Source: CNN 00:30 Now playing – Source: CNN 00:58 Now playing – Source: CNN 01:07 Now playing – Source: CNN 00:38 Now playing – Source: CNN 02:12 Now playing – Source: CNN 02:32 Now playing – Source: CNN Ivan Watson and Jadyn Sham ” data-timestamp-html=” Updated 11:32 AM EDT, Tue April 18, 2023 ” data-check-event-based-preview=”” data-is-vertical-video-embed=”false” data-network-id=”” data-publish-date=”2025-07-04T07:11:15.523Z” data-video-section=”world” data-canonical-url=”https://www.cnn.com/2025/07/04/world/video/chinese-pla-navy-fleet-hongkong-digvid” data-branding-key=”” data-video-slug=”chinese-pla-navy-fleet-hongkong-digvid” data-first-publish-slug=”chinese-pla-navy-fleet-hongkong-digvid” data-video-tags=”” data-breakpoints='{“video-resource–media-extra-large”: 660}’ data-display-video-cover=”true” data-details=””> 01:30 Now playing – Source: CNN 01:27 Now playing – Source: CNN 01:02 Now playing – Source: CNN By Hanako Montgomery and Bryan Dent Wood, CNN ” data-timestamp-html=” Updated 11:32 AM EDT, Tue April 18, 2023 ” data-check-event-based-preview=”” data-is-vertical-video-embed=”false” data-network-id=”” data-publish-date=”2025-07-03T10:59:15.948Z” data-video-section=”world” data-canonical-url=”https://www.cnn.com/2025/07/03/world/video/japan-manga-megaquake-july-5-digvid” data-branding-key=”” data-video-slug=”japan-manga-megaquake-july-5-digvid” data-first-publish-slug=”japan-manga-megaquake-july-5-digvid” data-video-tags=”” data-breakpoints='{“video-resource–media-extra-large”: 660}’ data-display-video-cover=”true” data-details=””> 04:31 Now playing – Source: CNN By Samantha Lindell, CNN ” data-timestamp-html=” Updated 11:32 AM EDT, Tue April 18, 2023 ” data-check-event-based-preview=”” data-is-vertical-video-embed=”false” data-network-id=”” data-publish-date=”2025-07-04T21:00:54.448Z” data-video-section=”sport” data-canonical-url=”https://www.cnn.com/2025/07/03/sport/video/mexican-boxer-detained-ice-sports-digvid” data-branding-key=”” data-video-slug=”mexican-boxer-detained-ice-sports-digvid” data-first-publish-slug=”mexican-boxer-detained-ice-sports-digvid” data-video-tags=”” data-breakpoints='{“video-resource–media-extra-large”: 660}’ data-display-video-cover=”true” data-details=””> 01:45 Now playing – Source: CNN 01:25 Now playing – Source: CNN 01:27 Now playing – Source: CNN 00:46 Now playing – Source: CNN 02:00 Now playing – Source: CNN See More Videos

Sign up for CNN’s Wonder Theory science newsletter. Explore the universe with news on fascinating discoveries, scientific advancements and more.

CNN  — 

Cruising at a depth of 8,336 meters (over 27,000 feet) just above the seabed, a young snailfish has become the deepest fish ever filmed by scientists during a probe into the abyss of the northern Pacific Ocean.

Scientists from University of Western Australia and Tokyo University of Marine Science and Technology released footage of the snailfish on Sunday filmed last September by sea robots in deep trenches off Japan.

Along with the filming the deepest snailfish, the scientists physically caught two other specimens at 8,022 meters and set another record for the deepest catch.

Previously, the deepest snailfish ever spotted was at 7,703 meters in 2008, while scientists had never been able to collect fish from anywhere below 8,000 meters.

“What is significant is that it shows how far a particular type of fish will descend in the ocean,” said marine biologist Alan Jamieson, founder of the Minderoo-UWA Deep Sea Research Centre, who led the expedition.

Caladan Oceanic

Scientists are filming in the trenches off Japan as part of a 10-year study into the deepest fish populations in the world. Snailfish are members of Liparidae family, and while most snailfish live in shallow water, others survive at some of the greatest depths ever recorded, Jamieson said.

During the two-month survey last year, three “landers” – automatic sea robots fitted with high-resolution cameras – were dropped into three trenches – the Japan, Izu-Ogasawara and Ryukyu trenches – at varying depths.

In the Izu-Ogasawara trench, footage showed the deepest snailfish hovering calmly alongside other crustaceans on the seabed.

Jamieson classified the fish as a juvenile and said younger deep sea snailfish often stay as deep as possible to avoid being eaten by bigger predators that swim at shallower depths.

Vezi mai multe știri aici

Another clip shot at between 7,500 and 8,200 meters in the same trench showed a colony of fish and crustaceans munching at bait tied to an undersea robot.

Images of the two captured snailfish – identified as Pseudoliparis belyaevi – provide a rare glimpse of the unique features that help the deep sea species survive the extreme environment.

They have tiny eyes, a translucent body, and their lack of swim bladder, which helps other fish float, works to their advantage, Jamieson said.

The professor said the Pacific Ocean is particularly conducive to vibrant activity due to its warm southern current, which encourages sea creatures to go deeper, while its abundant marine life provides a good source of food for bottom feeders.

Scientists would like to know more about creatures living at extreme depths, but cost is the constraint, Jamieson said, adding that each lander alone costs them $200,000 to assemble and operate.

“The challenges are that technology has been expensive and scientists don’t have a lot of money,” he said.

Sursa: CNN

Andrew Redington/Getty Images North America/Getty Images St. Louis Post-Dispatch/AP Bettmann Archive/Getty Images Augusta National/Getty Images Augusta National/Getty Images Augusta National/Getty Images David Cannon/Allsport/Getty Images David Cannon/Getty Images Europe/Getty Images Harry How/Getty Images Ezra Shaw / Getty Images Warren Little / Getty Images Donald Miralle/Getty Images Andrew Redington / Getty Images Harry How / Getty Images Jim Watson / AFP via Getty Images Sean M. Haffey / Getty Images Christian Petersen / Getty Images

Golf's biggest meltdowns

Prev Next

Editor’s Note: This story was originally published in April 2023.

CNN  — 

Slumped on his club, head buried in his arm, Rory McIlroy looked on the verge of tears.

The then-21-year-old had just watched his ball sink into the waters of Rae’s Creek at Augusta National and with it, his dream of winning The Masters, a dream that had looked so tantalizingly close mere hours earlier.

As a four-time major winner and one of the most decorated names in the sport’s history, few players would turn down the chance to swap places with McIlroy heading into Augusta this week.

Yet on Sunday afternoon of April 10, 2011, not a golfer in the world would have wished to be in the Northern Irishman’s shoes.

Flying

A fresh-faced, mop-headed McIlroy had touched down in Georgia for the first major of the season with a reputation as the leading light of the next generation of stars.

An excellent 2010 had marked his best season since turning pro three years earlier, highlighted by a first PGA Tour win at the Quail Hollow Championship and a crucial contribution to Team Europe’s triumph at the Ryder Cup.

Yet despite a pair of impressive top-three finishes at the Open and PGA Championship respectively, a disappointing missed cut at The Masters – his first at a major – served as ominous foreshadowing.

McIlroy shot 74 and 77 to fall four strokes short of the cut line at seven-over par, a performance that concerned him enough to take a brief sabbatical from competition.

Harry How / Getty Images

But one year on in 2011, any lingering Masters demons looked to have been exorcised as McIlroy flew round the Augusta fairways.

Having opened with a bogey-free seven-under 65 – the first time he had ever shot in the 60s at the major – McIlroy pulled ahead from Spanish first round co-leader Alvaro Quirós with a second round 69.

It sent him into the weekend holding a two-shot cushion over Australia’s Jason Day, with Tiger Woods a further stroke behind and back in the hunt for a 15th major after a surging second round 66.

And yet the 21-year-old leader looked perfectly at ease with having a target on his back. Even after a tentative start to the third round, McIlroy rallied with three birdies across the closing six holes to stretch his lead to four strokes heading into Sunday.

Andrew Redington / Getty Images

The youngster was out on his own ahead of a bunched chasing pack comprising Day, Ángel Cabrera, K.J. Choi and Charl Schwartzel. After 54 holes, McIlroy had shot just three bogeys.

“It’s a great position to be in … I’m finally feeling comfortable on this golf course,” McIlroy told reporters.

“I’m not getting ahead of myself, I know how leads can dwindle away very quickly. I have to go out there, not take anything for granted and go out and play as hard as I’ve played the last three days. If I can do that, hopefully things will go my way.

“We’ll see what happens tomorrow because four shots on this golf course isn’t that much.”

Timothy A. Clary / AFP via Getty Images

Falling

The truth can hurt, and McIlroy was about to prove his assessment of Augusta to be true in the most excruciating way imaginable.

His fourth bogey of the week arrived immediately. Having admitted to expecting some nerves at the first tee, McIlroy sparked a booming opening drive down the fairway, only to miss his putt from five feet.

Three consecutive pars steadied the ship, but Schwartzel had the wind in his sails. A blistering birdie, par, eagle start had seen him draw level at the summit after his third hole.

A subsequent bogey from the South African slowed his charge, as McIlroy clung onto a one-shot lead at the turn from Schwartzel, Cabrera, Choi, and a rampaging Woods, who shot five birdies and an eagle across the front nine to send Augusta into a frenzy.

Despite his dwindling advantage and the raucous Tiger-mania din ahead of him, McIlroy had responded well to another bogey at the 5th hole, draining a brilliant 20-foot putt at the 7th to restore his lead.

The fist pump that followed marked the high-water point of McIlroy’s round, as a sliding start accelerated into full-blown free-fall at the par-four 10th hole.

His tee shot went careening into a tree, ricocheting to settle between the white cabins that separate the main course from the adjacent par-three course. It offered viewers a glimpse at a part of Augusta rarely seen on broadcast, followed by pictures of McIlroy anxiously peering out from behind a tree to track his follow-up shot.

Andrew Redington / Getty Images

Though his initial escape was successful, yet another collision with a tree and a two-putt on the green saw a stunned McIlroy eventually tap in for a triple bogey. Having led the field one hole and seven shots earlier, he arrived at the 11th tee in seventh.

By the time his tee drive at the 13th plopped into the creek, all thoughts of who might be the recipient of the green jacket had long-since switched away from the anguished youngster. It had taken him seven putts to navigate the previous two greens, as a bogey and a double bogey dropped him to five-under – the score he had held after just 11 holes of the tournament.

Mercifully, the last five holes passed without major incident. A missed putt for birdie from five feet at the final hole summed up McIlroy’s day, though he was given a rousing reception as he left the green.

video

Related video Sunday at the Masters

Mere minutes earlier, the same crowd had erupted as Schwartzel sunk his fourth consecutive birdie to seal his first major title. After starting the day four shots adrift of McIlroy, the South African finished 10 shots ahead of him, and two ahead of second-placed Australian duo Jason Day and Adam Scott.

McIlroy’s eight-over 80 marked the highest score of the round. Having headlined the leaderboard for most of the week, he finished tied-15th.

Vezi toate știrile de pe criza tulburătoare masters

Robyn Beck / AFP via Getty Images

Bounce-back

Tears would flow during a phone call with his parents the following morning, but at his press conference, McIlroy was upbeat.

“I’m very disappointed at the minute, and I’m sure I will be for the next few days, but I’ll get over it,” he said.

“I was leading this golf tournament with nine holes to go, and I just unraveled … It’s a Sunday at a major, what it can do.

“This is my first experience at it, and hopefully the next time I’m in this position I’ll be able to handle it a little better. I didn’t handle it particularly well today obviously, but it was a character-building day … I’ll come out stronger for it.”

Once again, McIlroy would be proven right.

Just eight weeks later in June, McIlroy rampaged to an eight-shot victory at the US Open. Records tumbled in his wake at Congressional, as he shot a tournament record 16-under 268 to become the youngest major winner since Tiger Woods at The Masters in 1997.

Jim Watson / AFP via Getty Images

The historic victory kickstarted a golden era for McIlroy. After coasting to another eight-shot win at the PGA Championship in 2012, McIlroy became only the third golfer since 1934 to win three majors by the age of 25 with triumph at the 2014 Open Championship.

Before the year was out, he would add his fourth major title with another PGA Championship win.

And much of it was owed to that fateful afternoon at Augusta. In an interview with the BBC in 2015, McIlroy dubbed it “the most important day” of his career.

“If I had not had the whole unravelling, if I had just made a couple of bogeys coming down the stretch and lost by one, I would not have learned as much.

“Luckily, it did not take me long to get into a position like that again when I was leading a major and I was able to get over the line quite comfortably. It was a huge learning curve for me and I needed it, and thankfully I have been able to move on to bigger and better things.

“Looking back on what happened in 2011, it doesn’t seem as bad when you have four majors on your mantelpiece.”

Tom Pennington / Getty Images

The missing piece

McIlroy’s contentment came with a caveat: it would be “unthinkable” if he did not win The Masters in his career.

Yet as he prepares for his 15th appearance at Augusta National this week, a green jacket remains an elusive missing item from his wardrobe.

Despite seven top-10 finishes in his past 10 Masters outings, the trophy remains the only thing separating McIlroy from joining the ranks of golf immortals to have completed golf’s career grand slam of all four majors in the modern era: Gene Sarazen, Ben Hogan, Gary Player, Jack Nicklaus, and Tiger Woods.

Mike Mulholland / Getty Images

A runner-up finish to Scottie Scheffler last year marked McIlroy’s best finish at Augusta, yet arguably 2011 remains the closest he has ever been to victory. A slow start in 2022 meant McIlroy had begun Sunday’s deciding round 10 shots adrift of the American, who teed off for his final hole with a five-shot lead despite McIlroy’s brilliant 64 finish.

video

Related video Rory McIlroy: I will win the Masters

At 33 years old, time is still on his side. Though 2022 extended his major drought to eight years, it featured arguably his best golf since that golden season in 2014.

And as McIlroy knows better than most, things can change quickly at Augusta National.

Sursa: CNN

CNN  — 

It is one of China’s most popular shopping apps, selling clothing, groceries and just about everything else under the sun to more than 750 million users a month.

But according to cybersecurity researchers, it can also bypass users’ cell phone security to monitor activities on other apps, check notifications, read private messages and change settings.

And once installed, it’s tough to remove.

While many apps collect vast troves of user data, sometimes without explicit consent, experts say e-commerce giant Pinduoduo has taken violations of privacy and data security to the next level.

In a detailed investigation, CNN spoke to half a dozen cybersecurity teams from Asia, Europe and the United States — as well as multiple former and current Pinduoduo employees — after receiving a tipoff.

Multiple experts identified the presence of malware on the Pinduoduo app that exploited vulnerabilities in Android operating systems. Company insiders said the exploits were utilized to spy on users and competitors, allegedly to boost sales.

“We haven’t seen a mainstream app like this trying to escalate their privileges to gain access to things that they’re not supposed to gain access to,” said Mikko Hyppönen, chief research officer at WithSecure, a Finnish cybersecurity firm.

“This is highly unusual, and it is pretty damning for Pinduoduo.”

This is highly unusual, and it is pretty damning for Pinduoduo.

Mikko Hyppönen, cybersecurity expert

Malware, short for malicious software, refers to any software developed to steal data or interfere with computer systems and mobile devices.

Evidence of sophisticated malware in the Pinduoduo app comes amid intense scrutiny of Chinese-developed apps like TikTok over concerns about data security.

Some American lawmakers are pushing for a national ban on the popular short-video app, whose CEO Shou Chew was grilled by Congress for five hours last week about its relations with the Chinese government.

The revelations are also likely to draw more attention to Pinduoduo’s international sister app, Temu, which is topping US download charts and fast expanding in other Western markets. Both are owned by Nasdaq-listed PDD, a multinational company with roots in China.

While Temu has not been implicated, Pinduoduo’s alleged actions risk casting a shadow over its sister app’s global expansion.

There is no evidence that Pinduoduo has handed data to the Chinese government. But as Beijing enjoys significant leverage over businesses under its jurisdiction, there are concerns from US lawmakers that any company operating in China could be forced to cooperate with a broad range of security activities.

Mike Segar/Reuters/File

The findings follow Google’s suspension of Pinduoduo from its Play Store in March, citing malware identified in versions of the app.

An ensuing report from Bloomberg said a Russian cybersecurity firm had also identified potential malware in the app.

Pinduoduo has previously rejected “the speculation and accusation that Pinduoduo app is malicious.”

CNN has contacted PDD multiple times over email and phone for comment, but has not received a response.

Rise to success

Pinduoduo, which boasts a user base that accounts for three quarters of China’s online population and a market value three times that of eBay (EBAY), wasn’t always an online shopping behemoth.

Founded in 2015 in Shanghai by Colin Huang, a former Google employee, the startup was fighting to establish itself in a market long dominated by e-commerce stalwarts Alibaba (BABA) and JD.com (JD).

It succeeded by offering steep discounts on friends-and-family group buying orders and focusing on lower-income rural areas.

Pinduoduo posted triple digit growth in monthly users until the end of 2018, the year it listed in New York. By the middle of 2020, though, the increase in monthly users had slowed to around 50% and would continue to decline, according to its earnings reports.

VCG/VCG/Getty Images/File

It was in 2020, according to a current Pinduoduo employee, that the company set up a team of about 100 engineers and product managers to dig for vulnerabilities in Android phones, develop ways to exploit them — and turn that into profit.

According to the source, who requested anonymity for fear of reprisals, the company only targeted users in rural areas and smaller towns initially, while avoiding users in megacities such as Beijing and Shanghai.

“The goal was to reduce the risk of being exposed,” they said.

By collecting expansive data on user activities, the company was able to create a comprehensive portrait of users’ habits, interests and preferences, according to the source.

This allowed it to improve its machine learning model to offer more personalized push notifications and ads, attracting users to open the app and place orders, they said.

The team was disbanded in early March, the source added, after questions about their activities came to light.

PDD didn’t reply to CNN’s repeated requests for comment on the team.

What experts found

Approached by CNN, researchers from Tel Aviv-based cyber firm Check Point Research, Delaware-based app security startup Oversecured and Hyppönen’s WithSecure conducted independent analysis of the 6.49.0 version of the app, released on Chinese app stores in late February.

Google Play is not available in China, and Android users in the country download their apps from local stores. In March, when Google suspended Pinduoduo, it said it had found malware in off-Play versions of the app.

The researchers found code designed to achieve “privilege escalation”: a type of cyberattack that exploits a vulnerable operating system to gain a higher level of access to data than it’s supposed to have, according to experts.

“Our team has reverse engineered that code and we can confirm that it tries to escalate rights, tries to gain access to things normal apps wouldn’t be able to do on Android phones,” said Hyppönen.

Luo Yunfei/China News Service/VCG/Getty Images

The app was able to continue running in the background and prevent itself from being uninstalled, which allowed it to boost its monthly active user rates, Hyppönen said. It also had the ability to spy on competitors by tracking activity on other shopping apps and getting information from them, he added.

Check Point Research additionally identified ways in which the app was able to evade scrutiny.

The app deployed a method that allowed it to push updates without an app store review process meant to detect malicious applications, the researchers said.

They also identified in some plug-ins the intent to obscure potentially malicious components by hiding them under legitimate file names, such as Google’s.

“Such a technique is widely used by malware developers that inject malicious code into applications that have legitimate functionality,” they said.

Android targeted

In China, about three quarters of smartphone users are on the Android system. Apple (AAPL)’s iPhone has 25% market share, according to Daniel Ives of Wedbush Securities.

Sergey Toshin, the founder of Oversecured, said Pinduoduo’s malware specifically targeted different Android-based operating systems, including those used by Samsung, Huawei, Xiaomi and Oppo.

CNN has reached out to these companies for comment.

Toshin described Pinduoduo as “the most dangerous malware” ever found among mainstream apps.

“I’ve never seen anything like this before. It’s like, super expansive,” he said.

Urmărește cele mai importante știri

Most phone manufacturers globally customize the core Android software, the Android Open Source Project (AOSP), to add unique features and applications to their own devices.

Toshin found Pinduoduo to have exploited about 50 Android system vulnerabilities. Most of the exploits were tailor made for customized parts known as the original equipment manufacturer (OEM) code, which tends to be audited less often than AOSP and is therefore more prone to vulnerabilities, he said.

Pinduoduo also exploited a number of AOSP vulnerabilities, including one which was flagged by Toshin to Google in February 2022. Google fixed the bug this March, he said.

I’ve never seen anything like this before. It’s like, super expansive.

Sergey Toshin, Android security expert

According to Toshin, the exploits allowed Pinduoduo access to users’ locations, contacts, calendars, notifications and photo albums without their consent. They were also able to change system settings and access users’ social network accounts and chats, he said.

Of the six teams CNN spoke to for this story, three did not conduct full examinations. But their primary reviews showed that Pinduoduo asked for a large number of permissions beyond the normal functions of a shopping app.

They included “potentially invasive permissions” such as “set wallpaper” and “download without notification,” said René Mayrhofer, head of the Institute of Networks and Security at the Johannes Kepler University Linz in Austria.

Sheldon Cooper/SOPA Images/LightRocket/Getty Images

Disbanding the team

Suspicions about malware in Pinduoduo’s app were first raised in late February in a report by a Chinese cybersecurity firm called Dark Navy. Even though the analysis didn’t directly name the shopping giant, the report spread quickly among other researchers, who did name the company. Some of the analysts followed up with their own reports confirming the original findings.

Soon after, on March 5, Pinduoduo issued a new update of its app, version 6.50.0, which removed the exploits, according to two experts who CNN spoke to.

Two days after the update, Pinduoduo disbanded the team of engineers and product managers who had developed the exploits, according to the Pinduoduo source.

The next day, team members found themselves locked out of Pinduoduo’s bespoke workplace communication app, Knock, and lost access to files on the company’s internal network. Engineers also found their access to big data, data sheets and the log system revoked, the source said.

Most of the team were transferred to work at Temu. They were assigned to different departments at the subsidiary, with some working on marketing or developing push notifications, according to the source.

A core group of about 20 cybersecurity engineers who specialize in finding and exploiting vulnerabilities remain at Pinduoduo, they said.

Toshin of Oversecured, who looked into the update, said although the exploits were removed, the underlying code was still there and could be reactivated to carry out attacks.

Oversight failure

Pinduoduo has been able to grow its user base against a backdrop of the Chinese government’s regulatory clampdown on Big Tech that began in late 2020.

That year, the Ministry of Industry and Information Technology launched a sweeping crackdown on apps that illegally collect and use personal data.

In 2021, Beijing passed its first comprehensive data privacy legislation.

The Personal Information Protection Law stipulates that no party should illegally collect, process or transmit personal information. They’re also banned from exploiting internet-related security vulnerabilities or engaging in actions that endanger cybersecurity.

Pinduoduo’s apparent malware would be a violation of those laws, tech policy experts say, and should have been detected by the regulator.

“This would be embarrassing for the Ministry of Industry and Information Technology, because this is their job,” said Kendra Schaefer, a tech policy expert at Trivium China, a consultancy. “They’re supposed to check Pinduoduo, and the fact that they didn’t find (anything) is embarrassing for the regulator.”

The ministry has regularly published lists to name and shame apps found to have undermined user privacy or other rights. It also publishes a separate list of apps that are removed from app stores for failing to comply with regulations.

Pinduoduo did not appear on any of the lists.

They’re supposed to check Pinduoduo, and the fact that they didn’t find (anything) is embarrassing for the regulator.

Kendra Schaefer, tech policy expert

CNN has reached out to the Ministry of Industry and Information Technology and the Cyberspace Administration of China for comment.

On Chinese social media, some cybersecurity experts questioned why regulators haven’t taken any action.

“Probably none of our regulators can understand coding and programming, nor do they understand technology. You can’t even understand the malicious code when it’s shoved right in front of your face,” a cybersecurity expert with 1.8 million followers wrote last week in a viral post on Weibo, a Twitter-like platform.

The post was censored the next day.

CNN’s Kristie Lu Stout and Sean Lyngaas contributed reporting.

Sursa: CNN

Ce am acoperit aici

• O suspectă a fost reținută în legătură cu o explozie care a ucis un important blogger militar rus într-o cafenea din Sankt Petersburg, duminică.
• Finlanda va deveni oficial membră a alianței militare NATO în cadrul unei ceremonii care va avea loc marți la Bruxelles. Finlanda a depus o cerere comună de aderare alături de Suedia, la scurt timp după invazia Rusiei în Ucraina.
• Polonia a livrat Ucrainei „mai multe” avioane de vânătoare MiG-29. Președintele ucrainean Volodimir Zelenski este așteptat să viziteze Polonia miercuri.
• Reporterul Wall Street Journal, reținut la Moscova sub acuzația de „spionaj”, a depus apel împotriva arestării sale, potrivit știrilor de stat rusești. SUA au cerut „eliberarea imediată” a jurnalistului.
• Pe teren, estul Ucrainei continuă să se confrunte cu atacuri rusești neîncetate, bombardamentele ucigând cel puțin șase persoane în orașul Kostiantynivka.

Sursa: CNN