507 matches found
TikTok Fixes Flaws That Opened Android App to Compromise
Researchers have disclosed four high-severity flaws in the Android version of TikTok that could have easily been exploited by a seemingly benign third-party Android app. If successful, an attacker could fully compromise the target’s TikTok account. Public disclosure of the vulnerabilities was...
Spyware Labeled 'TikTok Pro' Exploits Fears of U.S. Ban
Researchers have discovered a new Android spyware campaign pushing a “Pro” version of the TikTok app that is exploiting fears among its young and gullible users that the popular social media app is on the cusp of being banned in the United States. The malware can take over basic device...
TikTok: Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data Exfiltration
The researcher discovered a URL parameter reflecting its value without being properly sanitized and was able to achieve reflected XSS. In addition, researcher found an endpoint which was vulnerable to CSRF. The endpoint allowed to set a new password on accounts which had used third-party apps to...
TikTok: Bypass SMS verification to delete TikTok account
Improper authorization could potentially allow an attacker to bypass SMS verification and delete a TikTok account. This attack would first require the account to be compromised. A fix has been implemented to resolve this issue. We thank @luizviana for reporting this to our team and confirming the...
Data scraping firm leaks 235m Instagram, TikTok, YouTube user records
By Sudais Asif According to researchers, the trove of data was left for public access without any security authentication. This is a post from HackRead.com Read the original post: Data scraping firm leaks 235m Instagram, TikTok, YouTube user records...
The NSA and FBI Expose Fancy Bear's Sneaky Hacking Tool
Plus: TikTok tracking, Russian SIMs, and more of this week's top security news...
TikTok collected MAC addresses for Android phones against Google’s ToS
By Zara Khan TikTok also collected unique identifiers and sent them to Byte Dance, its parent company. This is a post from HackRead.com Read the original post: TikTok collected MAC addresses for Android phones against Googles ToS...
TikTok Surreptitiously Collected Android User Data Using Google-Prohibited Tactic
TikTok has been collecting unique identifiers from millions of Android devices without their users’ knowledge using a tactic previously prohibited by Google because it violated people’s privacy, new research has found. Click to register! The app concealed the practice, which can track users onlin...
A week in security (August 3 – 9)
Last week on Malwarebytes Labs, on our Lock and Code podcast, we talked about identity and access management technology. We also wrote about business email compromises to score big, discussed how the Data Accountability and Transparency Act of 2020 looks beyond consent, and we analyzed how the...
TikTok: Multiple Cross-Site Scripting vulnerability via the language parameter
A cross site scripting vulnerability was reported across multiple TikTok domains leveraging the language parameter. This issue has been promptly resolved. We thank @luizviana for reporting this to our team and confirming the resolution...
TikTok: Cross Site Scripting using Email parameter in Ads endpoint 1
A cross site scripting vulnerability was found in the ads endpoint using the email parameter. This issue has been resolved. We thank @luizviana for reporting this to our team and confirming the resolution...
Trump's TikTok Drama Is a Distraction
As the White House zeroes in on a single app, some experts say more pressing issues are going by the wayside...
Lock and Code S1Ep12: Pinpointing identity and access management’s future with Chuck Brooks
This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Chuck Brooks, cybersecurity evangelist and adjunct professor for Georgetown University’s Applied Intelligence Program and graduate Cybersecurity Programs...
TikTok: Cross Site Scripting using Email parameter in Ads endpoint 2
A cross site scripting vulnerability was found in an ads endpoint using the email parameter. This issue has been resolved. We thank @luizviana for reporting this to our team and confirming the resolution...
TikTok is being discouraged and the app may be banned
In recent news retail giant Amazon sent a memo to employees telling them to delete the popular social media app TikTok from their phones. In the memo it stated that the app would pose a security risk without going into details. Later the memo was withdrawn without an explanation except that it wa...
TikTok: Open Redirect Vulnerability on TikTok Ads Portal
An Open Redirect vulnerability was found that could expose the user session cookie potentially allowing an attacker to obtain access to an account on the TikTok ads portal...
Does TikTok Really Pose a Risk to US National Security?
Concerns about the Chinese government shouldn't be dismissed, experts say. But banning TikTok would be a drastic measure...
Exclusive: Any Chingari App (Indian TikTok Clone) Account Can Be Hacked Easily
Following vulnerability disclosure in the Mitron app, another viral TikTok clone in India has now been found vulnerable to a critical but easy-to-exploit authentication bypass vulnerability, allowing anyone to hijack any user account and tamper with their information, content, and even upload...
New smishing scam spreads fake TikTok App loaded with malware
By Deeba Ahmed The smishing scam is targeting TikTok app users and fans in... This is a post from HackRead.com Read the original post: New smishing scam spreads fake TikTok App loaded with malware...