TikTok vulnerability exposed private user data

Security researchers have discovered that the app's 'Find Friends' feature allows hackers to access user details

TikTok app on a smartphone

Security researchers have discovered a flaw in TikTok that, if exploited, could expose users’ private data and enable an attacker to steal data on users’ contacts too.

According to Check Point Research, whose researchers discovered the flaw, if left unpatched, the vulnerability would have enabled an attacker to access a user’s phone number, TikTok nickname, profile and avatar pictures, unique user IDs, as well as certain profile settings, such as whether a user is a follower or if a user’s profile is hidden.

Researchers discovered the vulnerability in the TikTok app’s 'Find Friends' feature. This uses contacts syncing, which allows users to sync their contacts on their phone to easily find people they may know on TikTok. This makes it possible to connect users’ profile details to their phone numbers.

With those phone numbers and profile details, attackers could potentially access further information related to users, obtained outside of TikTok, such as searching for other accounts or data available.

Researchers described the process of exploiting the flaw. Each time a user launches the TikTok app, it performs a process of device registration to make sure users aren’t switching between devices.

Related Resource

How LogPoint uses MITRE ATT&CK

Stronger cyber security with MITRE ATT&CK

How to improve your cyber security with MITRE ATT&CK - A LogPoint whitepaperDownload now

During the SMS login process from a mobile device, TikTok servers validate the data by generating a token and session cookies. Researchers found the session cookies and token values expire after 60 days, meaning they could use the same cookies to log in for weeks.

Lastly, researchers found that a threat actor can successfully manipulate the sign-in process by bypassing TikTok’s HTTP Message signing, thereby automating the process of uploading and syncing contacts at scale, eventually building a database of users and their connected phone numbers for the threat actor to target.

Check Point Research responsibly disclosed its findings to ByteDance, TikTok’s maker, and the company deployed an updated version of the app to users.

Oded Vanunu, head of products vulnerabilities research at Check Point, said the primary motivation of the research was to explore the privacy of TikTok.

“We were curious to see if the TikTok platform could be used to gain access to private user data. We were able to bypass multiple protection mechanisms of TikTok, that led to privacy violations,” he said.

With the vulnerability enabling a hacker to build a database of user details and their respective phone numbers, they would have access to sensitive information and could perform a range of malicious activities, such as spear phishing or other criminal actions.

“Our message to TikTok users is to share the bare minimum, when it comes to your personal data, and to update your phone’s operating system and applications to the latest versions,” Vanunu said.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

Mastering endpoint security implementation
Security

Mastering endpoint security implementation

16 Apr 2021
US, UK say Russia was behind SolarWinds hack
cyber attacks

US, UK say Russia was behind SolarWinds hack

16 Apr 2021
Biden looks to shore up the electrical grid’s cyber security
Security

Biden looks to shore up the electrical grid’s cyber security

15 Apr 2021
Top US credit unions have multiple web app security problems
cyber security

Top US credit unions have multiple web app security problems

15 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
NSA uncovers new "critical" flaws in Microsoft Exchange Server
servers

NSA uncovers new "critical" flaws in Microsoft Exchange Server

14 Apr 2021
Xiaomi Redmi Note 10 Pro review: Champagne tastes on a lemonade budget
Mobile Phones

Xiaomi Redmi Note 10 Pro review: Champagne tastes on a lemonade budget

13 Apr 2021