A ‘high severity’ TikTok vulnerability allowed one-click account hijacking

guest · Sep 3, 2022

Hackers could have used the exploit to post videos, send messages, and edit account details
By Corin Faife @corintxt - August 31, 2022

A vulnerability in the TikTok app for Android could have let attackers take over any account that clicked on a malicious link, potentially affecting hundreds of millions of users of the platform.

Details of the one-click exploit were revealed today in a blog post from researchers on Microsoft’s 365 Defender Research Team. The vulnerability was disclosed to TikTok by Microsoft, and has since been patched.
Click to expand...

The bug and its resulting attack, labelled a “high severity vulnerability,” could have been used to hijack the account of any TikTok user on Android without their knowledge, once they clicked on a specially crafted link. After the link was clicked, the attacker would have access to all primary functions of the account, including the ability to upload and post videos, send messages to other users, and view private videos stored in the account.
Click to expand...

According to details published in the blog post, the vulnerability affected the deep link functionality of the Android app. This deep link handling tells the operating system to let certain apps process links in a specific way, such as opening the Twitter app to follow a user after clicking an HTML “Follow this account” button embedded in a webpage.
Click to expand...

Microsoft: Vulnerability in TikTok Android app could lead to one-click account hijacking

Microsoft discovered a high-severity vulnerability in the TikTok Android application, which could have allowed attackers to compromise users’ accounts with a single click. The vulnerability, which would have required several issues to be chained together to exploit, has been fixed and we did not locate any evidence of in-the-wild exploitation.

Attackers could have leveraged the vulnerability to hijack an account without users’ awareness if a targeted user simply clicked a specially crafted link. Attackers could have then accessed and modified users’ TikTok profiles and sensitive information, such as by publicizing private videos, sending messages, and uploading videos on behalf of users.
Click to expand...

Rasheed187 · Sep 2, 2022

This just proves how bad security truly is in many apps, this seems to be a huge design blunder. Nice find from M$.

Rasheed187 · Jun 8, 2024

It's a bit unclear to me how this exploit worked. I suppose it works only on smartphones and not on desktops. The second quote is from the Forbes article.

TikTok acknowledges exploit targeting high-profile accounts

TikTok says its security team is addressing an issue that allowed hackers to target several high-profile celebrity and brand accounts on its video platform, including those belonging to Paris Hilton, CNN and Sony.
Click to expand...

The malware is transmitted through DMs within the TikTok app, and does not require a download, click, response or any other act from users beyond opening a message. The hacked accounts do not appear to be posting content, and it’s unclear how many have been affected.
Click to expand...

https://techcrunch.com/2024/06/04/tiktok-acknowledges-exploit-targeting-high-profile-accounts/

https://www.forbes.com/sites/emilyb...celebrity-and-brand-accounts/?sh=551daa366060

Log in or Sign up

A ‘high severity’ TikTok vulnerability allowed one-click account hijacking

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

Log in or Sign up

A ‘high severity’ TikTok vulnerability allowed one-click account hijacking

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

Useful Searches