TikTok caught secretly spying on millions of iPhone users

Apple iOS apps can read the last thing copied to clipboard

Apple recently fixed a bug in iOS 14 that allows apps to secretly access the clipboard on Apple devices. The new OS will warn users when an app reads the last item copied to the clipboard, but several apps have already been caught invading people’s privacy, including TikTok, according to security researchers Talal Haj Bakry and Tommy Mysk

China’s Bytedance, owner of TikTok, stated the problem is tied to an outdated advertising SDK. However, according to the clipboard warning in iOS 14 beta, TikTok is continuing to abuse users’ privacy.

A company spokesperson said it was “triggered by a feature designed to identify repetitive, spammy behavior.” TikTok submitted an updated version of the app without the anti-spam feature to the App Store.

The TikTok spokesperson added: “The clipboard access issues showed up due to third-party SDKs, in our case an older version Google Ads SDK, so we do not get access to the information through this. We are in the processes of updating so that the third-party SDK will no longer have access.” 

Changes to Apple’s iOS 14 security and privacy settings helped to identify TikTok and other apps secretly accessing the clipboard. The vulnerability meant anything copied on a user’s Mac or iPad could be read by active apps on their iPhone, including passwords, work documents, personal emails and financial documents.

Apple’s iOS fix will force TikTok and other companies to update their apps.

Apple initially ignored the clipboard vulnerability, eventually publishing a fix following media coverage of the security findings. According to Bakry and Mysk, “Apple dismissed the risks that we highlighted and explained that iOS already had mechanisms to counter all of the risks. But the mechanisms that Apple provided were not effective to protect user privacy.” 

iPhone users should update their TikTok app when the newest version is released.

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Senator wants social media companies held liable for spreading anti-vax lies
social media

Senator wants social media companies held liable for spreading anti-vax lies

23 Jul 2021
5 most secure smartphones
Mobile Phones

5 most secure smartphones

28 Jun 2021
Four in ten Americans would rather give up a pet than social media
social media

Four in ten Americans would rather give up a pet than social media

21 Jun 2021
Senator reintroduces federal data protection bill
data protection

Senator reintroduces federal data protection bill

17 Jun 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Tesla Megapack goes up in flames at Australian battery site
Hardware

Tesla Megapack goes up in flames at Australian battery site

30 Jul 2021
PwnedPiper flaws threaten infrastructure of 80% of US hospitals
Security

PwnedPiper flaws threaten infrastructure of 80% of US hospitals

2 Aug 2021