Security Researchers Take Advantage of Insecure HTTP to Display Fake Videos on TikTok

MacRumors

macrumors bot
Original poster
Apr 12, 2001
48,667
10,094


An investigation by Talal Haj Bakry and Tommy Mysk has revealed that backwards-compatible support for HTTP in iOS and Android is allowing data from popular apps such as TikTok to be intercepted and altered.


While most apps have made the transition to HTTPS, the research discovered that TikTok on iOS and Android still uses unencrypted HTTP to download media content. Consequently, TikTok inherits all of the known and well-documented HTTP vulnerabilities.

Apple introduced App Transport Security in iOS 9, requiring all HTTP connections to use encrypted HTTPS. Google similarly changed the default network security configuration in Android Pie to block all plaintext HTTP traffic. HTTP vulnerabilities still exist, however, since Apple and Google continue provide a way for developers to opt-out of HTTPS for backwards-compatibility.


The investigation proved that it is possible to successfully intercept TikTok traffic and fool the app to show fake videos as if they were published by popular and verified accounts. Any router between the TikTok app and TikTok's servers can easily expose a user's watch history, and change profile photos and videos. While only users connected to the router will see the malicious content, the research suggests that if a popular DNS server was hacked to include a corrupt DNS record, media data could be changed on a large scale.

Article Link: Security Researchers Take Advantage of Insecure HTTP to Display Fake Videos on TikTok
 
Last edited:

4jasontv

macrumors 68020
Jul 31, 2011
2,383
2,425
Are fake videos just pictures or are they videos of things that didn’t actually happen?
 

MakeAppleAwesomeAgain

macrumors member
Nov 21, 2016
99
782
Amsterdam
...since Apple and Google continue provide a way for developers to opt-out of HTTPS for backwards-compatibility.
Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
 
Last edited:

phenste

macrumors member
Sep 16, 2012
78
371
Oops.
Having seen Vine come and go in what felt like an instant (while I was in high school), the fact that TikTok isn’t dead yet is a MARVEL to me. Especially with how clearly unsafe it is, and how clearly stupid all the teenage influencers on it are.

Vine was the genesis of Jake/Logan Paul, and the most we got out of that was a horribly-poor-taste YouTube video with a hanged corpse in the icon, and Post Malone’s house getting accidentally doxxed. (Yes, Jake Paul is stupid enough to accidentally dox someone.)

With TikTok, I feel like we could get the Chinese government somehow getting into the accounts of EVERY influencer, and every person that follows these influencers, and just…****ing something up majorly. I don’t know what, but if there’s anything I’ve learned in the last few months, it’s that you never know what’s around the corner.
 

AngerDanger

macrumors 601
Dec 9, 2008
4,689
21,245
808203E8-2EC5-4E56-A499-3E74DFBE1954.jpeg


It's amazing that thier example of malicious content is the paraphrased quote of a first world leader.
 
Last edited:
  • Like
Reactions: shadowbird423

lkrupp

macrumors 65816
Jul 24, 2004
1,027
1,534
Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
There’s no good reason not to use HTTPS just like there’s no good reason to use Flash... but developers and users DO continue to use them and scream bloody murder when things no longer work. macOS still supports Flash even though it’s a pos. And when something doesn’t work on their Apple gear it’s automatically Apple’s fault no matter what. Just look at all the rage at the 32/64 bit change and APFS. If Apple were to stop supporting HTTP many websites would go dead on the platform. It’s a catch-22.
 

AlexGraphicD

Suspended
Oct 26, 2015
346
282
New York
LMAO How can people be so clueless and download these kind of spyware in the first place? How can a Chinese social media app become so popular out of the confined borders of that communist regime in this day and age is beyond ridiculous.
 
Last edited:

fairuz

macrumors 68020
Aug 27, 2017
2,470
2,528
Silicon Valley
You can’t really blame them, it is mostly Apple’s and Google’s fault.
How, for allowing them to use HTTP at all? Maybe they shouldn't, but TikTok is doing something egregiously bad here.
- - Post merged: - -

Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
There are always legitimate reasons, but they should be very rare. Home IoT stuff is often HTTP. I wonder how Tik Tok's devs convinced Apple's reviewers their reason was good. Time to take down the app?
 
Last edited:

fairuz

macrumors 68020
Aug 27, 2017
2,470
2,528
Silicon Valley
What's the point?
HTTPS provides two distinct things together, the client verifying the authenticity of the server and the traffic being encrypted. Without it, someone who can see the traffic (someone on the same wifi network, or anyone snooping in the ISPs) can read everything between the client and the server. If that person can also modify the traffic, they can handle the client's requests and send back bogus responses, e.g. sending the wrong Tik Tok video back.

The article is kinda silly IMO because they call out displaying fake videos when really this is a broad vulnerability. I'm also surprised that pro security researchers had to discover this when any kid with Wireshark can.
 
Last edited:

fairuz

macrumors 68020
Aug 27, 2017
2,470
2,528
Silicon Valley
All true, but I guess Felix point was that if you rely on TikTok as source of information for anything serious you already have a bigger issue... the "genuine" content is already fake enough, it can't get much worse...
Also, whe usingTikTok, privacy is not among your priorities...
Ah, then I probably explained something he already knows. That always looks annoying, my bad.
Famous or extremely popular users on there at least have (and kinda deserve) more credibility than the rest, so faking their content could have an impact. And I wonder if the credentials are also sent in the clear.
 

69Mustang

macrumors 604
Jan 7, 2014
7,326
13,683
In between a rock and a hard place
Ah, then I probably explained something he already knows. That always looks annoying, my bad.
Famous or extremely popular users on there at least have (and kinda deserve) more credibility than the rest, so faking their content could have an impact. And I wonder if the credentials are also sent in the clear.
I disagree with that portion of your statement. A lot actually. Fame and/or popularity don't deserve more credibility. I really not even sure how you've formed that opinion. I'm pretty sure both you and I can name hundreds of famous people who are definitely not credible. Unfortunately, a lot of the world thinks that way so we end up with people who have suspect opinions and outsized influence. Such is life.
 
  • Like
Reactions: KeithBN

fairuz

macrumors 68020
Aug 27, 2017
2,470
2,528
Silicon Valley
I disagree with that portion of your statement. A lot actually. Fame and/or popularity don't deserve more credibility. I really not even sure how you've formed that opinion. I'm pretty sure both you and I can name hundreds of famous people who are definitely not credible. Unfortunately, a lot of the world thinks that way so we end up with people who have suspect opinions and outsized influence. Such is life.
Being a real person with a reputation to uphold automatically counts towards being more credible than a random anon user. Of course I'm not saying all famous people deserve more credibility. That's impossible because some of them outright call each other liars. But I'd automatically trust a comment here more if I knew it were from a person I know and haven't decided is a liar.
 
Last edited:

vault

macrumors regular
May 3, 2009
166
106
It's really not a big discovery that tiktok uses HTTP. When you embed a video on secure site or post a link on a slack-like service with preview you will get "site partially insecure" warning. In dev tools you can see a bunch of HTTP requests to tiktok servers.

What is surprising is Apple and Google still allowing it in apps. At least on www I can see what's going on and protect myself.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.