4 ms·
I looked through the comments to see if someone could provide me steps or evidence of what they did than just telling me about what they found. I have no doubt
by searchableguy 6y ago
I looked through the comments to see if someone could provide me steps or evidence of what they did than just telling me about what they found. I have no doubt tiktok is nefarious but most of the things are done by other players with some security problems mixed in.
On remote security problems, check this recent facebook SDK issue - https://github.com/facebook/facebook-ios-sdk/issues/1374 https://github.com/facebook/facebook-ios-sdk/issues/1374
I think snapchat also tries to detect whether you are trying to snoop in. There are many "privacy" focused app who employ those techniques. Not that I trust tiktok to do it for privacy reasons but they are not alone.
Why should I trust zimperium with their automated reports without an explanation of what they are checking. The link to report ask me about my phone number, email, name, and what not. Seems ironic.
I stopped reading through the other link which points to nowhere now (someone put a gdrive link in the comments). Why censor the code or is that just dummy code to make it spicy?
I would avoid tiktok like I did before but don't blind yourself about other popular non chinese apps.
I am also curious about the reason for adding a way to unzip and execute binaries.
- jjoonathan 6y agoBackdoors are "bad security practices rather than looking malicious"? > There's also a few snippets of code on the Android version that allows for the downloading of a remote zip file, unzipping it, and executing said binary. That sure looks malicious to me. EDIT: Ditto for the active evasion. > For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent
- searchableguy 6y agoYeah that one seems bad. Although isn't android cracking down on the functionality? I thought that was the reason why Termux wouldn't work anymore. https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An... I can't say anything about the second statement without knowing op's background.
- deleted 6y ago[deleted]
- Thorrez 6y ago> Also on security problems, check this recent facebook SDK issue - https://github.com/facebook/facebook-ios-sdk/issues/1374 https://github.com/facebook/facebook-ios-sdk/issues/1374 Is that a security problem?
- searchableguy 6y agoI think it is. Facebook remotely crashed all their apps. The SDK depends on the information from the server on startup. The facebook SDK shares a lot of information on startup that the OP in the comment points tiktok of doing. https://github.com/facebook/facebook-ios-sdk/issues/1374#issuecomment-625251773 https://github.com/facebook/facebook-ios-sdk/issues/1374#iss...
- Thorrez 6y agoTheoretically it could crash at startup and not share much info (just IP address of the user).