Ankit_sharma03 Posted June 29, 2020 Author Share Posted June 29, 2020 ab warner aur chahal kya karenge beetle 1 Link to comment Share on other sites More sharing options...
coffee_rules Posted June 29, 2020 Share Posted June 29, 2020 Watch for tweets from eminent journalists, “my driver’s daughter was a TikTok star, now she will not have 3k amdani she was getting from ads Gollum 1 Link to comment Share on other sites More sharing options...
Norman Posted June 29, 2020 Share Posted June 29, 2020 I can still see it in play store. Link to comment Share on other sites More sharing options...
Norman Posted June 29, 2020 Share Posted June 29, 2020 By the way , it's not going to do much as our mujra doing youth will get it from a different site using VPN or something. Their addiction to this krap is on a whole another level. Gollum and Clarke 2 Link to comment Share on other sites More sharing options...
Norman Posted June 29, 2020 Share Posted June 29, 2020 From Reddit.... A Guy explains how tiktok collects data #### Edit: Please read to avoid confusion: I'm getting a lot of DM's asking me to prove the majority of this with a paper and snippets of the offending code. I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. I have some frida scripts that I pushed to my git server as well as some markdown files + conversation logs I've had with exploit devs, but not much else. In order to get everyone the proof they require, I'll likely need to reverse the app all over again which isn't something I have time for right now. I'm planning on putting up a simple site/blog with what I have and will be updating this comment with the link when it's done. Thank you all for giving this issue your attention, and thank you to everyone who is scrutinizing my claims. We need more of that in this current age of disinformation. --- So I can personally weigh in on this. I reverse-engineered the app, and feel confident in stating that I have a very strong understanding for how the app operates (or at least operated as of a few months ago). TikTok is a data collection service that is thinly-veiled as a social network. If there is an API to get information on you, your contacts, or your device... well, they're using it. - Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc) - Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?) - Everything network-related (ip, local ip, router mac, your mac, wifi access point name) - Whether or not you're rooted/jailbroken - Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC - They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their native libraries (have fun reading all of that assembly, assuming you can get past their customized fork of OLLVM!!!) and manually inspect every single obfuscated function. They have several different protections in place to prevent you from reversing or debugging the app as well. App behavior changes slightly if they know you're trying to figure out what they're doing. There's also a few snippets of code on the Android version that allows for the downloading of a remote zip file, unzipping it, and executing said binary. There is zero reason a mobile app would need this functionality legitimately. On top of all of the above, they weren't even using HTTPS for the longest time. They leaked users' email addresses in their HTTP REST API, as well as their secondary emails used for password resets. Don't forget about users' real names and birthdays, too. It was allllll publicly viewable a few months ago if you MITM'd the application. They provide users with a taste of "virality" to entice them to stay on the platform. Your first TikTok post will likely garner quite a bit of likes, regardless of how good it is.. assuming you get past the initial moderation queue if thats still a thing. Most users end up chasing the dragon. Oh, there's also a ton of creepy old men who have direct access to children on the app, and I've personally seen (and reported) some really suspect stuff. 40-50 year old men getting 8-10 year old girls to do "duets" with them with sexually suggestive songs. Those videos are posted publicly. TikTok has direct messaging functionality. Here's the thing though.. they don't want you to know how much information they're collecting on you, and the security implications of all of that data in one place, en masse, are *ing huge. They encrypt all of the analytics requests with an algorithm that changes with every update (at the very least the keys change) just so you can't see what they're doing. They also made it so you cannot use the app at all if you block communication to their analytics host off at the DNS-level. For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare. ### tl;dr; I'm a nerd who figures out how apps work for a job. Calling it an advertising platform is an understatement. TikTok is essentially malware that is targeting children. Don't use TikTok. Don't let your friends and family use it. --- Edit: Well this blew up - sorry for the typos, I wrote this comment pretty quick. I appreciate the gold/rewards/etc people, but I'm honestly just glad I'm finally able to put this information in front of people (even if it may outdated by a few months). If you're a security researcher and want to take a look at the most recent versions of the app, send me a PM and I'll give you all of the information I have as a jumping point for you to do your thing. --- ### Edit 2: More research.. /u/kisuka left the following comment [here](https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fn1e2e3/): > Piggy-backing on this. Penetrum just put out their TikTok research: https://penetrum.com/research/tiktok/ ## Edit 2: Damn people. You necromanced the hell out of this comment. ## Edit 3: Updated the Penetrum link + added Zimperium's report (requires you request it manually) The above Penetrum link appears to be gone. Someone else linked the paper here: https://penetrum.com/research Zimperium put out a report awhile ago too: https://blog.zimperium.com/zimperium-analyzes-tiktoks-security-and-privacy-risks/ ### Edit 4: Messages So this post blew up for the third time. I've responded to over 200 replies and messages in the last 24 hours, but haven't gotten to the 80 or so DM's via the chat app. I intend on getting to them soon, though. I'm going to be throwing together a blog or something very soon and publishing some info. I'll update this post as soon as I have it up. Link to comment Share on other sites More sharing options...
coffee_rules Posted June 29, 2020 Share Posted June 29, 2020 2 hours ago, Norman said: By the way , it's not going to do much as our mujra doing youth will get it from a different site using VPN or something. Their addiction to this krap is on a whole another level. yeh hai hamare yuva shakti Gollum and Clarke 2 Link to comment Share on other sites More sharing options...
Norman Posted June 30, 2020 Share Posted June 30, 2020 9 hours ago, coffee_rules said: yeh hai hamare yuva shakti Man this is scary really. When your youth thinks it's good only for mujra on tiktok and pretty much useless without it , there is something wrong with the whole system. Link to comment Share on other sites More sharing options...
LordPrabhzy Posted June 30, 2020 Share Posted June 30, 2020 11 hours ago, coffee_rules said: yeh hai hamare yuva shakti Haaan foreign countries tum jaise chewtiyon ke liye haath khol ke khadi hai na. Delusion ki bhi koi hadh hoti hai. Link to comment Share on other sites More sharing options...
LordPrabhzy Posted June 30, 2020 Share Posted June 30, 2020 There is talks that people will bypass the ban by accessing the app via a VPN. Maybe that is the case but the Gov should also bring a supplementary law that any company caught sponsoring or paying for marketing to any TikTok ‘star’ in the future, it will be a hefty fines in the crores. You need to stop their revenue streams so they think twice before making this a ‘career’ Gollum 1 Link to comment Share on other sites More sharing options...
Norman Posted June 30, 2020 Share Posted June 30, 2020 It's gone from play store now. Link to comment Share on other sites More sharing options...
Gollum Posted June 30, 2020 Share Posted June 30, 2020 coffee_rules 1 Link to comment Share on other sites More sharing options...
coffee_rules Posted June 30, 2020 Share Posted June 30, 2020 Link to comment Share on other sites More sharing options...
Gollum Posted June 30, 2020 Share Posted June 30, 2020 Meltdown is unreal Link to comment Share on other sites More sharing options...
coffee_rules Posted June 30, 2020 Share Posted June 30, 2020 Chinese brokers plenty. Link to comment Share on other sites More sharing options...
LordPrabhzy Posted June 30, 2020 Share Posted June 30, 2020 Link to comment Share on other sites More sharing options...
Rasgulla Posted June 30, 2020 Share Posted June 30, 2020 21 hours ago, LordPrabhzy said: Nachooo re Nachooo BC. Bigger win than winning a WC. Link to comment Share on other sites More sharing options...
Gollum Posted June 30, 2020 Share Posted June 30, 2020 Gandmasti chalu Link to comment Share on other sites More sharing options...
Gollum Posted June 30, 2020 Share Posted June 30, 2020 Link to comment Share on other sites More sharing options...
sergio04 Posted June 30, 2020 Share Posted June 30, 2020 coffee_rules 1 Link to comment Share on other sites More sharing options...
diga Posted June 30, 2020 Share Posted June 30, 2020 (edited) 1 hour ago, coffee_rules said: Chinese brokers plenty. Ask tiktok to return every paise earned from India Edited June 30, 2020 by diga coffee_rules 1 Link to comment Share on other sites More sharing options...
Recommended Posts