Pinduoduo - CVE-2023-20963 and a leaked potentially compromised signing key

tl;dr

Chinese shopping app deployed LPE 0day when distributed via some channels.

Confused situation.. expect more to follow

Analysis

* [https://mp-weixin-qq-com.translate.goog/s/P\_EYQxOEupqdU0BJMRqWsw?\_x\_tr\_sl=auto&\_x\_tr\_tl=en&\_x\_tr\_hl=en-US](https://mp-weixin-qq-com.translate.goog/s/P_EYQxOEupqdU0BJMRqWsw?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US)
* [https://github-com.translate.goog/davinci1012/pinduoduo\_backdoor\_unpacker?\_x\_tr\_sl=ru&\_x\_tr\_tl=en&\_x\_tr\_hl=en&\_x\_tr\_pto=wapp](https://github-com.translate.goog/davinci1012/pinduoduo_backdoor_unpacker?_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp)

News:

[https://arstechnica.com/information-technology/2023/03/android-app-from-china-executed-0-day-exploit-on-millions-of-devices/](https://arstechnica.com/information-technology/2023/03/android-app-from-china-executed-0-day-exploit-on-millions-of-devices/)

0day analysis app blueteamsec chinese compromised cve distributed expect key leaked lpe pinduoduo shopping signing