Shahzaz ud din
SENIOR MEMBER
- Joined
- Jun 12, 2017
- Messages
- 7,877
- Reaction score
- 14
- Country
- Location
India's viral TikTok rival Desi Version ‘Mitron installed by 5M indians.... is made in Pakistan
SUSHOVAN SIRCARKARAN SAINIUPDATED: 29 MAY 2020, 07:56 PM IST
TECH AND AUTO8 min read
SHARE, SAVE, COMMENT
SUSHOVAN SIRCARKARAN SAINIUPDATED: 29 MAY 2020, 07:56 PM IST
TECH AND AUTO8 min read
SHARE, SAVE, COMMENT
- E
- Mitron App, which has recently been in the news for being downloaded over 5 million times and positioned as India’s answer to Tik Tok, may not have been developed by an Indian from IIT Roorkee.
A detailed analysis and decompiling of the app’s source code by The Quint, has revealed that Mitron, which has ridden high on an anti-China and anti-TikTok sentiment, has, in fact, been rebranded from an app called TicTic, developed by a Pakistan-based company QBoxus.
Launched on 11 April, the credit for developing the app was given to Shivank Agarwal, a student at IIT Roorkee. Mitron is a short video-making application that allows users to upload short videos of up to 15 seconds.
It has now emerged that Agarwal has not developed the app himself, as previously claimed in various media reports, but has purchased TicTic’s code and simply rebranded it.A perusal of the decompiled source codes of the two apps has revealed that several strings with TicTic have been left as it is.
For example, “com.dinosoftlabs.tictic>>Main_Menu>>MainMenuFragment” as seen in the Mitron’s code still contains ‘tictic’.Moreover, “com.dinosoftlabs.tictic” is the Android package name and Google Play Store ID for the app published by Qboxus.
QBoxus has put the source code of its micro-video sharing app on sale on Code Canyon, a site where one can purchase pre-built sites, scripts, plugins applications and even themes.
The source code is on sale for $34 or approximately Rs 2,570. Mitron, however, may not even be the sole purchaser. The Tic Tic application source code has been sold 274 times, according to the Code Canyon website.Mitron’s Identical Source Code
An initial glance at both applications does indicate that certain features might be similar, but that could perhaps be written-off as both of them attempting to emulate the Tik Tok user experience.
What cannot be written-off as an attempt to emulate the Tik Tok user experience, however, is what decompiling the source code of both applications reveals.
Both applications share almost exactly the same libraries, as well as several functions named in a completely identical manner.Below, one can see TicTic app’s code, followed by a screenshot of Mitron App’s code.
TicTic’s library
(Image: Karan Saini)
Mitron’s library
(image: Karan Saini)
More NewsThe Pakistani company has raised two specific issues:- The real author of the app to be acknowledged and credited instead of attributing Shivank Agarwal as the creator of the app.
- The absence of any original modifications to the purchased code. “The worst thing is that the developer even didn't bother to fix bugs and issues in the app and directly uploaded it on Play Store, which is really a shame,” he added.
Identical Login Screen
The login screen for both apps shares an identical schema as well. Both can be seen using “action_login.xml”
action_login.xml for TicTic
(image: Karan Saini)
action_login.xml for Mitron
(image: Karan Saini)
TicTic Strings Left Behind in Mitron’s Code
Further, a ‘change_log’ file present in the decompiled Mitron source code contains the string “com.dinosoftlabs.tictic” – which is the package name of the TicTic application developed and released by QBoxus.
TicTic’s change_log file
(image: Karan Saini)
However, there are some minor differences to be noted in the User Interface (UI).
The splash screen which welcomes the user to the app differs visually across both. Further, Mitron does not currently allow users to log in via Facebook, whereas TicTic does.Apart from this, the application programming interface (API) for both applications are completely identical, which alone allows one to fully ascertain the claim that Mitron is indeed only a re-skinned iteration of TicTic.
TicTic’s Security Flaw Also In Mitron
Regardless, while re-skinned applications are not an entirely new phenomenon, they come with their own drawbacks.
For instance, a vulnerability that exists in the original codebase is likely to propagate to all other instances of the application and remain unfixed in each and every one of them.
This is also the case for TicTic and Mitron, as both applications share a common security flaw in the way through which the ‘follow account’ action is handled.The flaw can allow a malicious actor to force other users to follow any given account, simply by tampering with a few parameters on the ‘follow user’ request.
Mitron Has A Different Backend Though
Although it would be correct to state that both applications share the same code base, it should be clarified that this does not mean the same backend is shared among both applications.
The Mitron app’s server and API are located on shopkiller.in, whereas the TicTic application communicates with bringthings.com. This means that both user data as well as uploaded videos for Mitron are stored on a separate server (an Amazon Web Services S3 instance to be specific) in contrast to TicTic.
This particular application was able to blur the lines between an individually developed platform versus a generic rip-off.This is made evident by the number of people who have so far downloaded and installed the application (a number which is resting at 5 million at the time of publication).
In the context of Mitron, it’s meteoric rise in popularity can probably be attributed to it being touted as an “Indian version” of Tik Tok.
(Karan Saini is a security researcher and technologist from New Delhi, India. He works as a product support engineer with Bengaluru-based HasGeek.)
We'll get through this! Meanwhile, here's all you need to know about the Coronavirus outbreak to keep yourself safe, informed, and updated.
The Quint is now available on Telegram & WhatsApp too, Click here to join.
Published: 29 May 2020, 07:48 PM IST
Follow our Tech and Auto section for more stories.
One in aQuintillion
Follow Us On:
‘Great Platform’: IT Minister Hails Repackaged & Unsafe Mitron App
https://thequint.com/tech-and-auto/...-setu-more?utm_source=wru&utm_medium=alsoread
https://thequint.com/tech-and-auto/...y-concerns?utm_source=wru&utm_medium=alsoread
https://thequint.com/sports/sports-...-expecting?utm_source=wru&utm_medium=alsoread
Last edited:
