Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Security Researchers Take Advantage of Insecure HTTP to Display Fake Videos on TikTok

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
67,564
37,953


An investigation by Talal Haj Bakry and Tommy Mysk has revealed that backwards-compatible support for HTTP in iOS and Android is allowing data from popular apps such as TikTok to be intercepted and altered.

tiktok-logo.jpg

While most apps have made the transition to HTTPS, the research discovered that TikTok on iOS and Android still uses unencrypted HTTP to download media content. Consequently, TikTok inherits all of the known and well-documented HTTP vulnerabilities.

Apple introduced App Transport Security in iOS 9, requiring all HTTP connections to use encrypted HTTPS. Google similarly changed the default network security configuration in Android Pie to block all plaintext HTTP traffic. HTTP vulnerabilities still exist, however, since Apple and Google continue provide a way for developers to opt-out of HTTPS for backwards-compatibility.


The investigation proved that it is possible to successfully intercept TikTok traffic and fool the app to show fake videos as if they were published by popular and verified accounts. Any router between the TikTok app and TikTok's servers can easily expose a user's watch history, and change profile photos and videos. While only users connected to the router will see the malicious content, the research suggests that if a popular DNS server was hacked to include a corrupt DNS record, media data could be changed on a large scale.

Article Link: Security Researchers Take Advantage of Insecure HTTP to Display Fake Videos on TikTok
 
Article Link
https://www.macrumors.com/2020/04/18/tiktok-http-vulnerability/
Last edited:
Are fake videos just pictures or are they videos of things that didn’t actually happen?
 
MacRumors said:
...since Apple and Google continue provide a way for developers to opt-out of HTTPS for backwards-compatibility.
Click to expand...

Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
 
Last edited:
  • Like
Reactions: twistedpixel8 and GeoStructural
Oops.
Having seen Vine come and go in what felt like an instant (while I was in high school), the fact that TikTok isn’t dead yet is a MARVEL to me. Especially with how clearly unsafe it is, and how clearly stupid all the teenage influencers on it are.

Vine was the genesis of Jake/Logan Paul, and the most we got out of that was a horribly-poor-taste YouTube video with a hanged corpse in the icon, and Post Malone’s house getting accidentally doxxed. (Yes, Jake Paul is stupid enough to accidentally dox someone.)

With TikTok, I feel like we could get the Chinese government somehow getting into the accounts of EVERY influencer, and every person that follows these influencers, and just…****ing something up majorly. I don’t know what, but if there’s anything I’ve learned in the last few months, it’s that you never know what’s around the corner.
 
  • Like
Reactions: Oblivious.Robot, Michaelgtrusa, twistedpixel8 and 3 others
808203E8-2EC5-4E56-A499-3E74DFBE1954.jpeg


It's amazing that thier example of malicious content is the paraphrased quote of a first world leader.
 
Last edited:
  • Like
Reactions: shadowbird423
MakeAppleAwesomeAgain said:
Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
Click to expand...

There’s no good reason not to use HTTPS just like there’s no good reason to use Flash... but developers and users DO continue to use them and scream bloody murder when things no longer work. macOS still supports Flash even though it’s a pos. And when something doesn’t work on their Apple gear it’s automatically Apple’s fault no matter what. Just look at all the rage at the 32/64 bit change and APFS. If Apple were to stop supporting HTTP many websites would go dead on the platform. It’s a catch-22.
 
  • Like
Reactions: SDJim, bernuli, KeithBN and 1 other person
LMAO How can people be so clueless and download these kind of spyware in the first place? How can a Chinese social media app become so popular out of the confined borders of that communist regime in this day and age is beyond ridiculous.
 
Last edited:
  • Like
  • Love
Reactions: Michaelgtrusa, JWiLL1988 and KeithBN
GeoStructural said:
You can’t really blame them, it is mostly Apple’s and Google’s fault.
Click to expand...
How, for allowing them to use HTTP at all? Maybe they shouldn't, but TikTok is doing something egregiously bad here.
[automerge]1587229757[/automerge]
MakeAppleAwesomeAgain said:
Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
Click to expand...
There are always legitimate reasons, but they should be very rare. Home IoT stuff is often HTTP. I wonder how Tik Tok's devs convinced Apple's reviewers their reason was good. Time to take down the app?
 
Last edited:
  • Like
Reactions: Michaelgtrusa and CreatorCode
FelixDerKater said:
What's the point?
Click to expand...
HTTPS provides two distinct things together, the client verifying the authenticity of the server and the traffic being encrypted. Without it, someone who can see the traffic (someone on the same wifi network, or anyone snooping in the ISPs) can read everything between the client and the server. If that person can also modify the traffic, they can handle the client's requests and send back bogus responses, e.g. sending the wrong Tik Tok video back.

The article is kinda silly IMO because they call out displaying fake videos when really this is a broad vulnerability. I'm also surprised that pro security researchers had to discover this when any kid with Wireshark can.
 
Last edited:
[AUT] Thomas said:
All true, but I guess Felix point was that if you rely on TikTok as source of information for anything serious you already have a bigger issue... the "genuine" content is already fake enough, it can't get much worse...
Also, whe usingTikTok, privacy is not among your priorities...
Click to expand...
Ah, then I probably explained something he already knows. That always looks annoying, my bad.
Famous or extremely popular users on there at least have (and kinda deserve) more credibility than the rest, so faking their content could have an impact. And I wonder if the credentials are also sent in the clear.
 
fairuz said:
Ah, then I probably explained something he already knows. That always looks annoying, my bad.
Famous or extremely popular users on there at least have (and kinda deserve) more credibility than the rest, so faking their content could have an impact. And I wonder if the credentials are also sent in the clear.
Click to expand...
I disagree with that portion of your statement. A lot actually. Fame and/or popularity don't deserve more credibility. I really not even sure how you've formed that opinion. I'm pretty sure both you and I can name hundreds of famous people who are definitely not credible. Unfortunately, a lot of the world thinks that way so we end up with people who have suspect opinions and outsized influence. Such is life.
 
  • Like
Reactions: KeithBN
69Mustang said:
I disagree with that portion of your statement. A lot actually. Fame and/or popularity don't deserve more credibility. I really not even sure how you've formed that opinion. I'm pretty sure both you and I can name hundreds of famous people who are definitely not credible. Unfortunately, a lot of the world thinks that way so we end up with people who have suspect opinions and outsized influence. Such is life.
Click to expand...
Being a real person with a reputation to uphold automatically counts towards being more credible than a random anon user. Of course I'm not saying all famous people deserve more credibility. That's impossible because some of them outright call each other liars. But I'd automatically trust a comment here more if I knew it were from a person I know and haven't decided is a liar.
 
Last edited:
It's really not a big discovery that tiktok uses HTTP. When you embed a video on secure site or post a link on a slack-like service with preview you will get "site partially insecure" warning. In dev tools you can see a bunch of HTTP requests to tiktok servers.

What is surprising is Apple and Google still allowing it in apps. At least on www I can see what's going on and protect myself.
 
  • Like
Reactions: phajtol, AlexGraphicD and iGeek2019
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back