507 matches found
A TikTok ‘Car Theft’ Challenge Is Costing Hyundai $200 Million
Plus: The FBI gets busted abusing a spy tool, an ex-Apple engineer is charged with corporate espionage, and collection of airborne DNA raises new privacy risks...
How You, or Anyone, Can Dodge Montana’s TikTok Ban
Montana’s TikTok ban will be impossible to enforce. But it could encourage copycat crackdowns against the social media app...
Meta Uncovers Massive Social Media Cyber Espionage Operations Across South Asia
Three different threat actors leveraged hundreds of elaborate fictitious personas on Facebook and Instagram to target individuals located in South Asia as part of disparate attacks. "Each of these APTs relied heavily on social engineering to trick people into clicking on malicious links,...
Imperva Red Team Discovers Vulnerability in TikTok That Can Reveal User Activity and Information
TL;DR The Imperva Red Team discovered a vulnerability in TikTok, a popular social media platform with more than one billion users worldwide, that could allow attackers to monitor users activity on both mobile and desktop devices. This vulnerability, which has now been fixed, was caused by a windo...
Woman tracks down and turns table on Airbnb scammer
The internet is full of Airbnb scams and accounts told by victims. But there is a twist in this latest story-gone-viral that is usually lacking in most narratives: The victim evens the score. Airbnb host and scammer "Mr. Tyler" met his match when his would-be guest, TikTok user Olivia @livvoogus,...
Montana’s Looming TikTok Ban Is a Dangerous Tipping Point
The state is poised to be the first in the US to block downloads of the popular app, which could ignite a precarious chain reaction for digital rights...
A week in security (April 3 - 9)
Last week on Malwarebytes Labs: TikTok: Whats going on and should I be worried? Super FabriXss: an RCE vulnerability in Azure Service Fabric Explorer Big changes to Twitter verification: How to spot a verified account New macOS malware steals sensitive info, including a user's entire Keychain...
TikTok misused children's data, faces $15.6M fine
TikTok has been ordered to pay a fine of $15.6M £12.7M for failing to protect 1.4 million UK children under the age of 13 from accessing its platform in 2020. The Information Commissioner's Office ICO, the UK's data protection watchdog, imposed the fine after finding the company used children's...
TikTok: What’s going on and should I be worried?
Since 2020, several governments and organizations have banned, or considered banning, the immensely popular social media app TikTok from their staffs devices. With all these alarming bells ringing, we thought it might be handy to break down what we know and see if we can plot a sensible strategy...
The TikTok Hearing Revealed That Congress Is the Problem
The interrogation of CEO Shou Zi Chew highlighted US lawmakers’ own failure to pass privacy legislation...
TikTok Paid for Influencers to Attend the Pro-TikTok Rally in DC
The embattled social media company brought out the checkbook to ensure at least 30 of its biggest assets—creators—were in DC to help fend off critics...
TikTok: Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/
Vulnerability description not provided...
A week in security (March 6 - 12)
Last week on Malwarebytes Labs: 8 cybersecurity tips to keep you safe when travelling National Cybersecurity Strategy Document: What you need to know Intel CPU vulnerabilities fixed. But should you update? Warning issued over Royal ransomware Play ransomware gang leaks City of Oakland data...
TikTok "a loaded gun" says NSA
America's TikTok-addicted youth is playing with a "loaded gun" according to General Paul Nakasone, Director of the National Security Agency NSA. Speaking at a US Senate hearing on Wednesday, the general said "one third of Americans get their news from TikTok", adding "one sixth of American youth...
TikTok: 1 Click to 'Close Account and Refund' via POSTMESSAGE
A vulnerability was reported where a TikTok Ads endpoint sending postmessages sent POST requests without proper origin checks. This could have enabled a cross-site request forgery CSRF attack to force users to send malicious POST requests. The vulnerability was reported through responsible...
TikTok: CSRF in ticket function
A cross-site request forgery CSRF vulnerability was found on a TikTok Shop endpoint, which could have resulted in the arbitrary creation of tickets. The vulnerability was reported by @ibrahim0936356 to the TikTok team...
TikTok: Unrestricted File Upload on https://partner.tiktokshop.com/wsos_v2/oec_partner/upload
Vulnerability description not provided...
Banning TikTok
Congress is currently debating bills that would ban TikTok in the United States. We are here as technologists to tell you that this is a terrible idea and the side effects would be intolerable. Details matter. There are several ways Congress might ban TikTok, each with different efficacies and si...
TikTok probed over child privacy practices
The privacy protection authorities for Canada, Quebec, British Columbia, and Alberta have announced they will start an investigation into TikTok's privacy practices, especially in relation to its younger users. The investigation will include whether the company obtained valid and meaningful conse...