TikTok Flaws Allowed Hackers to Delete Videos, Steal User Info

guest · Jan 8, 2020

TikTok Flaws Allowed Hackers to Delete Videos, Steal User Info
January 8, 2020
https://www.bleepingcomputer.com/ne...wed-hackers-to-delete-videos-steal-user-info/

Security researchers found several vulnerabilities within TikTok’s infrastructure that made it possible for potential attackers to hijack accounts to manipulate users' videos and steal their personal information.
TikTok's applications and its backend were vulnerable to attacks as Check Point researchers state in a report shared with Bleeping Computer earlier this week.
TikTok's vulnerable SMS system
TikTok's SMS system allowed the Check Point research team to manipulate account data by adding and deleting videos, to demonstrate privacy encroachment issues by changing video privacy settings from private to public, and to exfiltrate personal user data including full name, email address, and birthday.

To be able to perform these malicious actions, hackers could send app download links to any user's phone number via text messages by impersonating TikTok which allowed them to inject and execute malicious code.

"The redirection opens the possibility of accomplishing Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), and Sensitive Data Exposure attacks without user consent."
Click to expand...

Check Point: Tik or Tok? Is TikTok secure enough?

guest · Apr 13, 2020

Developers spoofed a TikTok server and replaced real videos with fakes
It seems TikTok hasn't jumped on the HTTPS bandwagon yet
April 13, 2020
https://www.imore.com/developers-spoofed-tiktok-server-and-replaced-real-videos-fakes

TikTok is hot right now but it's already had a security scare after it turned out the app could read your iPhone's clipboard without your knowledge. Now things are even worse – people can create fake videos and make them appear as if they came from verified and trusted accounts.

The revelation came after developers Talal Haj Baktry and Tommy Mysk shared details about their escapades in a blog post. The gist is surprisingly simple – TikTok pulls videos from a content delivery network (CDN) via a standard HTTP connection. That means there's no encryption. And that means the whole thing can be spoofed.

"After a short session of capturing and analyzing network traffic from the TikTok app with Wireshark, it is hard to miss the large amounts of data transferred over HTTP. If you inspect the network packets closer, you would clearly spot data of videos and images being transferred in the clear and unencrypted."
So the two developers set about creating their own server and pointing their DNS server at it. That meant that any request for one of TikTok's three media servers went to a server that was owned by the developers. And then they went to work.
Click to expand...

This threat does require that someone have access to the DNS server your device is using.
But that's easier than you might think. Internet Service Providers, unscrupulous VPN companies, governments, and more could all tamper with DNS entries. Especially if you happen to live in certain parts of the world.
Click to expand...

TikTok Vulnerability Enables Hackers to Show Users Fake Videos

Conclusion
We successfully intercepted TikTok traffic and fooled the app to show our own videos as if they were published by popular and verified accounts. This makes a perfect tool for those who relentlessly try to pollute the internet with misleading facts.
TikTok, a social networking giant with around 800 million monthly active users, must adhere to industry standards in terms of data privacy and protection.
Click to expand...

Log in or Sign up

TikTok Flaws Allowed Hackers to Delete Videos, Steal User Info

guest Guest

guest Guest

Log in or Sign up

TikTok Flaws Allowed Hackers to Delete Videos, Steal User Info

guest Guest

guest Guest

Useful Searches