死死团
精华
|
战斗力 鹅
|
回帖 0
注册时间 2019-5-21
|
这谁做的还用说嘛
看看国外安卓专业人士的分析，指着菊厂直接开骂官方在mate30上留后门进行盗版了
https://www.androidcentral.com/h ... install-google-apps
Such an undocumented permission is very unusual and, if abused, potentially bad for security. Users do, however, have to choose to give an app Administrator permissions before they could be affected. And there are other security measures in place, which we'll get to soon, with Huawei acting as a gatekeeper for all its various MDM permissions. Yet, as Wu explains in his article, storing the original versions of system apps on the same writeable storage as other user apps opens up the possibility of easier tampering if some other security vulnerability is discovered. (Unlikely, but certainly not impossible.)
Wu combed through the Chinese documentation for Huawei's MDM SDK for more clues. He says that in order to use any of the MDM APIs, developers need to sign agreements with Huawei, justify their use of MDM permissions, and submit APK files for approval. Once approved, Wu says, Huawei provides a digital certificate necessary for the permissions to work.
And that only makes the situation with LZPlay all the more strange. Having undocumented MDM permissions that can install new system apps is certainly not normal, but at the same time it's the only way users could install Google services to an unlicensed phone, without completely torpedoing Android's built-in security. Yet the idea of the anonymous developer of LZPlay going through the lengthy MDM API approval process and gaining Huawei's blessing is even more bizarre.
Wu accuses Huawei of being "well aware" of LZPlay, and of allowing its continued existence:
At this point, it is pretty obvious that Huawei is well aware of this "LZPlay" app, and explicitly allows its existence. The developer of this app has to somehow be aware of these undocumented APIs, sign the legal agreements, go through several stages of reviews, and eventually have the app signed by Huawei. The sole purpose of the app is to install Google Services on a non licensed device, and it sounds very sketchy to me, but I'm no lawyer so I have absolutely no idea of its legality. |
|
沪公网安备 31010702007642号 )
发表于 2019-10-2 22:46
发表于 2019-10-3 09:03