Viral selfie app Meitu causes privacy concerns over many permissions
Unfortunately, it seems like the hilarity of turning Donald Trump into a K-Pop star comes at an unfair price. Security-conscious people have been poking about Meitu’s internals, and have allegedly stumbled upon some sketchy lines of code. Furthermore, the Android version of the app asks for a silly amount of permissions that should worry even the most nonchalant of yes-men. Although every selfie app needs access to your camera and photo gallery, Meitu asks for pretty much every permission in the book – to check on running apps, your current location, read and modify the contents of your USB storage, see your device’s unique identification numbers (IMSIs), access call information, wifi connections, and more.
Summary: Meitu is a throw-together of multiple analytics and marketing/ad tracking packages, with something cute to get people to use it.
— Jonathan Zdziarski (@JZdziarski) January 19, 2017
This is what security researcher Jonathan Zdziarski had to say about Meitu
Although Meitu is not the only permission-hungry free app out there, not by a long shot, the unique IMSI numbers it acquires can be used for tracking users across the web, security researchers claim. A lot of the data Meitu collects is being send to unknown third-parties, although the company claims all of it is used for identity protection, service upgrades, and the like. It is very much possible that Meitu is just selling its users’ data to ad companies for ad targeting – a practice that is very common for Chinese companies developing free mobile apps. Still, we would advise to at least glance through what permissions an app needs before installing it on your smartphone, and if it’s a bunch too many for what it is, you may want to consider giving it a pass.
"To get around this, Meitu employs a combination of third-party and in-house data tracking systems to make sure the user data tracked is consistent. Furthermore, the data collected is sent securely, using multilayer encryption to servers equipped with advanced firewall, IDS and IPS protection to block external attacks," a Meitu spokesperson told CNET.
Things that are NOT allowed: