Check Point security researchers discovered a critical flaw in TikTok that could have exposed many users’ data and phone numbers to hackers. This was at the level of the protocol used to sync contacts with the app members’ profiles. It was later reported and patched by the firm.
Despite being the most downloaded app of 2020, TikTok is not without its flaws. Cybersecurity research institute Check Point has uncovered a major flaw in the social network, making it vulnerable to any hacker Personal data of millions of usersThis allowed access to profile details as well as phone numbers associated with the account. an indefinite period of time.
The flaw lies in functionality”Find friends“It offers to synchronize your contacts to find the profiles of those you know. The latter is based on two HTTP requests : The first to send the names of people and their associated numbers to TikTok; and a second to find the profiles of users associated with the numbers and view their nicknames, photos, and other information.
TikTok Makes Personal Data of Millions of Users Accessible
Normally profile syncing is limited to: 500 people, users and devices per dayCheck Point still managed to get around this limitation by recovering the necessary elements for identification, namely the server’s cookies and the token used when connecting via SMS, and replicating everything on the server. an Android emulator.
Using this method, a hacker can manipulate HTTP requests to obtain as many phone numbers as he wants. automate the process. In this way, it can create a database of accounts connected by this protocol. It will also be possible to access full details of synchronized profiles and accordingly look for other personal data to be stolen from third-party platforms. Check Point warned TikTok about the existence of this flaw. corrected.
Source : Checkpoint
Support our work ❤️
If you enjoyed this article, consider leaving a tip to help us keep publishing great content.
