TikTok: Open Redirect TO Stealing aadvid

An open redirect was found on TikTok Ads due to an improper validation of the "redirect" parameter. We thank @lu3ky-13 for reporting this to our team...

TikTok: Reflected XSS on TikTok Website

A cross-site scripting XSS vulnerability was found on TikTok.com via multiple parameters. We thank @homosec for reporting this to our team and confirming its resolution...

Data analytics firm exposed 2m Instagram and TikTok users’ data

By Deeba Ahmed The victims of this "data leak" also include celebrities like Alicia Keys, Loren Gray, Kylie Jenner, Ariana Grande, and Kim Kardashian. This is a post from HackRead.com Read the original post: Data analytics firm exposed 2m Instagram and TikTok users data...

TikTok: HTML Injection via TikTok Ads Email Share

A HTML injection was found on a TikTok Ads endpoint via the "SenderName" parameter. We thank @lu3ky-13 for reporting this to our team...

TikTok: Cross-site Scripting (XSS) - Stored on ads.tiktok.com in Text field

A XSS cross-site scripting vulnerability was found in TikTok ads through "text" field. We thank @lu3ky-13 for reporting this to our team...

TikTok Serves Up Fresh Gamer Targets

TikTok has made people do all sorts of wild things — eat frozen honey, work on their choreography and even fall for malicious malvertising campaigns. The latest TikTok attacks are getting served to gamers on the platform disguised as “free” or “hacked” versions of games like Among Us, free Steam...

A week in security (Oct 11 – Oct 17)

Last week on Malwarebytes Labs Google warns some users that FancyBear’s been prowling around Inside Apple: How macOS attacks are evolving The joy of phishing your employees ExpressVPN made a choice, and so did I: Lock and Code S02E19 Update now! Apple patches another privilege escalation bug in i...

“Free Steam game” scams on TikTok are Among Us

TikTok has long since evolved beyond being thought of as "just" dance clips, also becoming a home for educational and informative content presented in a fun and casual way. There are accounts themed around pretty much any interest you can think of, and one of the biggest is gaming. Its not all...

TikTok: Reflected XSS in TikTok endpoints

Cross site scripting vulnerability was found in few TikTok endpoints using the region parameter. We thank @sh1yo for reporting this to our team...

TikTok: HTML Injection on tiktoktutorials via firstName parameter

HTML injection was found in tiktoktutorials endpoint which could have potentially allowed attackers to modify the content of the email and trick users into visiting malicious sites. We thank @siratsami for reporting this to our team...

TikTok: BYPASSING COMMENTING ON RESTRICTED AUDIENCE VIDEOS

A vulnerability was identified in TikTok comments which could have potentially allowed users to bypass the commenting restriction by responding to existing comments via video message. We thank @boynamedboy for reporting this to our team and confirming the resolution...

Experts Uncover Mobile Spyware Attacks Targeting Kurdish Ethnic Group

Cybersecurity researchers on Tuesday released new findings that reveal a year-long mobile espionage campaign against the Kurdish ethnic group to deploy two Android backdoors that masquerade as legitimate apps. Active since at least March 2020, the attacks leveraged as many as six dedicated Facebo...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...

TikTok: Incorrect authorization to the intelbot service leading to ticket information

An authentication bypass and site wide stored XSS cross-site scripting vulnerability was found on TikTok Ads as JWT JSON Web Token was not verified properly. We thank @johnstone for reporting this to our team and confirming its resolution...

TikTok: XSS on tiktok.com

A cross site scripting vulnerability was found in a TikTok endpoint using the returnurl parameter. We thank @@arifmkhls for reporting this to our team and confirming the resolution...

TikTok: Multiple IDORs in family pairing api

An IDOR Insecure Direct Object Reference vulnerability was found on a TikTok Family Pairing endpoint which could have been used to disable various features. We thank @s3c for reporting this to our team and confirming the fix. Write up...

Another Hacker Arrested for 2020 Twitter Hack and Massive Bitcoin Scam

A U.K. citizen has been arrested in the Spanish town of Estepona over his alleged involvement in the July 2020 hack of Twitter, resulting in the compromise of 130 high-profile accounts. Joseph O'Connor, 22, has been charged with intentionally accessing a computer without authorization and obtaini...

CVE-2020-24143

Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...

CVE-2020-24142

Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...

CVE-2020-24143

Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...