• Home
  • Apps
  • Apps News
  • TikTok Vulnerabilities Could Allow Account Takeover by Hackers, More: All You Need to Know

TikTok Vulnerabilities Could Allow Account Takeover by Hackers, More: All You Need to Know

TikTok security flaw found by Check Point Research has now been fixed. Users are recommended to update to the latest app versions as a precaution.

Share on Facebook Tweet Snapchat Share Reddit Comment
TikTok Vulnerabilities Could Allow Account Takeover by Hackers, More: All You Need to Know

TikTok user data was under threat, but thankfully, the company has fixed the flaws

Highlights
  • TikTok users could be tricked by SMS spoofing into losing account control
  • Hackers could do damages like deleting clips or exposing sensitive data
  • A TikTok sub-domain was also found to be vulnerable to XSS attacks

TikTok has been in the news lately for all the wrong reasons. Take for example the ban imposed by US Army, preventing soldiers from using the viral app on government-issued phones citing security concerns. Now, Check Point research has reported multiple vulnerabilities in the TikTok app that could allow hackers to gain control of a user account and manipulate its content, erase videos, change the privacy status, and do a lot more damage. Thankfully, the vulnerabilities in TikTok have now been fixed. While most of the fixes were on the back-end, users are recommended to update their apps to the latest version to be on the safe side.

Check Point Research mentions in its blog post that it was possible to send an SMS message to a mobile number on behalf of TikTok. This functionality is available on the official TikTok website to let users download the app. However, hackers can capture HTTP request using a proxy tool and spoof a message that can contain any harmful link the malicious party intends to send. The link in question can then redirect users to a malicious website, and this was made possible because the redirection process was found to be vulnerable. This further opens the possibility of launching Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and Sensitive Data Exposure attacks. 

Once this happens, the attacker can take advantage of multiple intermediary techniques to become a follower of the victim and wreak havoc. The possible damage scenarios include deleting someone's TikTok videos, upload unauthorised clips, make ‘private' videos public, and even expose sensitive personal information associated with a TikTok account such as the linked email address, birth dates, payment details, and more. It is essentially equivalent to having a complete account takeover. Thankfully, Check Point Research notified TikTok about the vulnerability and the flaw was fixed before the findings were made public.

The security experts at Check Point Research also discovered that a TikTok subdomain (https://ads.tiktok.com) was vulnerable to XSS attacks, which could allow hackers to inject malicious scripts in trusted websites. In the case of TikTok, the injection point for launching an XSS attack was found in the search functionality. The Check Point Research blog post also notes that TikTok employed an unconventional JSONP callback that makes it possible to request data from API servers without CORS and SOP restrictions, which made it possible to steal data by initiating an AJAX request. 

“TikTok is committed to protecting user data. Like many organisations, we encourage responsible security researchers to privately disclose zero day vulnerabilities to us. Before public disclosure, CheckPoint agreed that all reported issues were patched in the latest version of our app. We hope that this successful resolution will encourage future collaboration with security researchers,” Luke Deshotels from TikTok Security Team's was quoted as saying in Check Point Research' press release.

Comments

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

TikTok Bans 'Misleading Information' That Could Cause Harm to Its Community or the Public
Jio Wi-Fi Calling Service Launched, Supports Over 150 Mobile Devices: Check How to Enable, Benefits

Related Stories

 
 

Advertisement

Advertisement

© Copyright Red Pixels Ventures Limited 2020. All rights reserved.
Listen to the latest songs, only on JioSaavn.com