Cybersecurity researchers at Imperva have uncovered a significant security flaw in the popular social media app TikTok, which could have potentially allowed threat actors to access and exfiltrate sensitive user data. The vulnerability, now fixed by TikTok, involved the app’s handling of incoming messages, which could be exploited to extract valuable information from victim devices.
The exploit involved sending a malicious message through the TikTok web application using the PostMessage API, evading security measures in place. Once the message was processed by the app’s event handler, the attacker could gain access to user data, including device details, viewed videos, time spent on each video, user account information, and search queries.
The discovery of this vulnerability adds to the ongoing concerns surrounding TikTok, which has faced scrutiny due to its Chinese ownership by ByteDance. With over 1.5 billion users worldwide, including millions in the United States, TikTok has faced accusations of potential privacy breaches and unauthorized access due to its association with the Chinese government.
The US government has taken steps to address these concerns, including mandating data storage within the country and imposing restrictions on TikTok’s usage on government-issued devices. The vulnerability uncovered by Imperva further underscores the need for robust security measures and reinforces the ongoing debate surrounding Chinese companies and potential national security risks.
TikTok has denied any involvement in wrongdoing and maintains that it prioritizes user privacy and data protection. However, this incident highlights the importance of continuous monitoring and prompt remediation of security vulnerabilities to safeguard user data and maintain user trust in social media platforms.