Meituan Deletes Photos in Android Permission Bug

🔑 Enhanced Key Takeaways

• •The incident was traced to a specific version of a third-party advertising SDK integrated into the Meituan app, which incorrectly identified the root directory of the user's photo gallery as a temporary cache folder during a routine cleanup operation.
• •Security researchers identified that the vulnerability exploited the 'Scoped Storage' bypass mechanisms that some older apps maintained to ensure compatibility with legacy Android versions, allowing the SDK to bypass modern OS-level file protection.
• •Following the incident, the Cyberspace Administration of China (CAC) launched a targeted audit of Meituan's data handling practices, specifically focusing on the 'minimal necessity' principle for third-party SDKs.

🛠️ Technical Deep Dive

• •The bug originated from a logic error in a file-path resolution function within the SDK, which used a hardcoded path string that failed to account for dynamic storage partitioning on newer Android versions.
• •The SDK utilized the 'File.delete()' method in Java/Kotlin without implementing a recursive check for directory contents, leading to the accidental deletion of non-cache files when the path resolution pointed to the root of the DCIM folder.
• •The incident highlighted a failure in the app's sandboxing architecture, where the SDK was granted broad 'WRITE_EXTERNAL_STORAGE' permissions, which, prior to Android 11's strict Scoped Storage enforcement, allowed unrestricted access to the entire shared storage volume.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline