Data Breaches

TikTok Account could be hacked by Sending SMS


TikTok, the famous Chinese viral video-sharing app had potentially dangerous vulnerabilities that could have let remote attackers to hijack any user account by just knowing the mobile number of targeted victims.

TikTok which is the 3rd most downloaded app in 2019 was under intense scrutiny over users’ privacy, censoring politically controversial content and on national-security grounds. But now the security of its billions of users was at risk.

The cybersecurity researchers at Check Point revealed that chaining multiple vulnerabilities allowed them to remotely execute malicious code and perform unwanted actions on behalf of the victims without their knowledge.

The vulnerabilities include low severity issues like SMS link spoofing, open redirection, and cross-site scripting (XSS) which when combined would let a remote attacker to perform high impact attacks like

  • deleting any videos from victims’ TikTok profile,
  • uploading unauthorized videos to victims’ TikTok profile,
  • making private “hidden” videos public,
  • reveal personal information saved on the account, like private addresses and emails.

The attack leverages an insecure SMS system that TikTok offers on its website to let users send a message to their phone number with a link to download the video-sharing application

The researchers stated that an attacker could send an SMS message to any phone number on behalf of TikTok with a modified download URL to a malicious page designed to execute code on a targeted device with already installed TikTok app.

Due to open redirection and cross-site scripting issues, when the victims click the link sent by TikTok server over SMS, the attack could allow hackers to execute JavaScript code on behalf of victims.

This technique is commonly known as cross-site request forgery attack, wherein attackers trick authenticated users into executing an unwanted action.

With the lack of anti-Cross-Site request forgery mechanism, we realized that we could execute JavaScript code and perform actions on behalf of the victim, without their consent.

Redirecting the user to a malicious website will execute JavaScript code and make requests to Tiktok with the victims’ cookies.

Check Point reported these vulnerabilities to the developer of TikTok, ByteDance in late November 2019, who then released a patched version of its mobile app within a month to protect its users from hackers.

Those users who are not running the latest version of TikTok available on official app stores for Android and iOS, are highly recommended to update it at the earliest.

Priyanka R
Cyber Security Enthusiast, Security Blogger, Technical Editor, Author at Cyber Safe News

    15 Data Security Predictions for 2020

    Previous article

    Minnesota Hospital Breach exposed medical info of 50 K

    Next article

    You may also like


    Leave a reply

    Your email address will not be published. Required fields are marked *