7 ms·

Apple Suddenly Catches TikTok Secretly Spying on Millions of iPhone Users

94 points by dsr12 6y ago

justicezyx 6y ago
According to what I learned from friends who work at tiktok, the parent company are planning to formally sever the business tie with tiktok. Although the technology team is assumed to still share the same infrastructure (networking storage compute etc.). I never was a web or mobile app developer and my friends are not either, and I never used tiktok so have no idea how the client side technology going to be structure. PS: Tiktok and the purely algorithm driven content consumption is absolutely going to be a super mind washing machine that I will never going to touch, and will teach my kids to stay away as well.
- vulcan01 6y ago
  > absolutely going to be a super mind washing machine Perhaps; your greater worry should be that kids are prioritising TikTok over other, more important things (like school/sleep) > will teach my kids to stay away as well Good luck; it's going to be hard, especially when all their friends will be using it. (Source: I'm a high schooler ;) ) Perhaps an easier path is to teach them to avoid all/most social media. That's what my dad told me to do, and to date I find it a lot easier to say "I'm not on any social media" than "I'm not on TikTok" to my friends. (HN arguably is social media though...)
  - bosswipe 6y ago
    HN may be social media, and it can be addictive. But the real crack are infinite scrolling algorithmic feeds optimized for engagement. HN doesn't have one of those.
- jeffbee 6y ago
  That's an interesting claim. TikTok has been recruiting rapidly in America, and they structure their offers mostly in terms of their non-fungible funny money, marked to a fantastic valuation (I think they told me Bytedance was worth $300bn or something preposterous). I wonder how they would pay out in a severance of TikTok from the parent company.
  - justinclift 6y ago
    > they structure their offers mostly in terms of their non-fungible funny money Any more info on that? From memory of previous discussion on HN, all shares/options/similar in mainland Chinese companies are (I think?) worthless to foreigners? With something about people only finding that out the hard way when they tried to cash them in.
    - chvid 6y ago
      Tiktok will ipo on an American exchange and effectively become an American company. The proceeds of the ipo will go to bytedance who will also continue to own and run the Chinese version.
      - justinclift 6y ago
        Ahhh, that makes more sense then. Thanks. :)
- ikeyany 6y ago
  Don't algorithms dictate what content shows up on HN?
  - TheSpiceIsLife 6y ago
    Not all algorithms are created equal.
  - rapsey 6y ago
    HN is quite heavily moderated. So is TikTok (much more so).
  - justicezyx 6y ago
    Really? I always assumed HN just operate on user voting. And the first batch showing on front-page is handed picked, which I think it's necessary...
vulcan01 6y ago
Previous discussion: https://news.ycombinator.com/item?id=23634138 https://news.ycombinator.com/item?id=23634138
personjerry 6y ago
They also caught like 20 other popular apps doing the same thing including NYTimes, Google News, and even Google Chrome. Instead of highlighting all of those, the article chooses to play on the "evil chinese" theme, for more sensationalist headlines. Appalling, in my opinion.
- fouc 6y ago
  Yup. No one upvote this article because it's clickbait
- bobobob420 6y ago
  "evil chinese theme" LOL. It is much more dangerous for the Chinese government to have access to more data on users than NYT or other corporations. In the previously article written by the author he says "TikTok stands out, though, given its much wider security concerns." "Sensationalist Headline". Headline of article: "Beware If You Use TikTok On Your iPhone: Here’s Why You Should Now Worry—New Security Report". Much wow, so much sensationalism in this title. Snooping for passwords and personal data on the clipboard, I guess we should not worry about TikTok. That is why the DOD banned it's use on their bases, they banned all other apps right?
  - deanCommie 6y ago
    > LOL. It is much more dangerous for the Chinese government to have access to more data on users than NYT or other corporations. 20 years ago this would have been a no-brainer statement. 5 years ago you'd say "Well, yes, through PRISM and many other NSA problems, if a private US corporation has your data, so does the US government. But don't worry, the Government doesn't care about individual citizens, and wouldn't use that maliciously." In 2020, do you really think that the Trump administration would have any qualms about using any NSA data against their "enemies" (which includes Journalists not bending to the spin of the administration?) Honestly, the only reason I think it hasn't been done yet is Trump is too stupid to realize all the tools available to his disposal. If you're a Chinese citizen, you should be more afraid of the Chinese Government, yes. If you're a US citizen, you should be much much more afraid of the US government. And as a citizen of neither, I'm afraid of both equally.
reactspa 6y ago
What I find odd: - why was iOS allowing it in the first place? - why does an app have access to the clipboard unless copy/paste is deliberately invoked from within the app by the user? (my clipboard often contains highly sensitive info)
- pat2man 6y ago
  Probably for performance reasons. If I copy an image I want it to paste immediately.
- statictype 6y ago
  There are good reasons for enabling an api for copying to the clipboard. A password manager should be able to copy passwords to the clipboard without the user having to select the plain text password in a text field. Not sure about pasting.
  - TheSpiceIsLife 6y ago
    > A password manager Should have a dedicated API to transmit passwords to password fields. Or, more broadly, if I had half a brain I’d get in to digital security research, so much low hanging fruit!
    - novok 6y ago
      There is a dedicated password api system, but sometimes, you just run into apps or websites that don't integrated with that API well.
- kstrauser 6y ago
  There are legitimate user-centric reasons for doing this: - I have an app, Parcel, that upon launch sees if I have something resembling a tracking number in my clipboard. If I do, it asks if I want to track that package. - A popular Reddit client, Apollo, looks for Reddit URLs in the clipboard. If it finds one, it asks if you want to open that conversation in the app. Sure, both of those apps work fine without that feature. Those are definitely nice conveniences, though, and they’re designed to make my life as the user just a little easier. So, there are genuinely useful reasons for an app to do this. There’s zero legit reason for TikTok to check every 30 seconds that don’t involve spyware. I want a dialog box: “Allow this app to access your clipboard?”, just like you get for access to location services, photos, the camera and mic, etc. Then I can let well-behaved apps do that for my benefit, and can tell creeper apps like TikTok to mind their own damn business.
justinclift 6y ago
> The most acute issue with this vulnerability is Apple’s universal clipboard functionality, which means that anything I copy on my Mac or iPad can be read by my iPhone, and vice versa. Didn't know that was a thing. What an extraordinary security hole that is, and excellent MiTM password catching opportunity for Apple. Does anyone know if it can be disabled programmatically? Otherwise LastPass (etc) are effectively getting backed up directly by Apple. :(
- ThePowerOfFuet 6y ago
  Why are you even putting passwords in the clipboard? On iOS and macOS passwords can (and should!) be filled by password manager extensions, which don't use the clipboard.
  - theklr 6y ago
    Unfortunately there’s still “trash” apps that don’t utilize the feature. I wish Apple pushed on this as much as they did with their sign with Apple policy.
  - 0x262d 6y ago
    they don't always work well.
  - jedberg 6y ago
    Sometimes you have to copy/paste your password for some apps. Quite often on the iPhone.
  - justinclift 6y ago
    That's probably a good point, for those. :) There are systems which use passwords stored locally (encrypted) though, and use cut-n-paste from the displayed password into the appropriate field. This "Apple universal clipboard" functionality sounds incredibly dangerous for things like that, if it can't be disabled. That being said, I haven't personally used macOS much in years, apart from keeping a project build server ticking over. So, this doesn't affect me personally that I know of. ;)
- 6y ago
newbie578 6y ago
I wonder if Apple would dare apply it's policies in this case? Flagging TikTok and angering motherland China? Who are we kidding, of course they won't, Apple are one of the most pro-china american companies.
TheSpiceIsLife 6y ago
The last paragraph: > All iPhone users should update to the latest version of TikTok as soon as it’s released—and given it is actively reading your clipboard, you might want to bear that in mind while using the app ahead of that update. Is immediately followed by this bit about the author of the article: Zak Doffman I am the Founder/CEO of Digital Barriers—developing advanced surveillance solutions for defence, national security and counter-terrorism. I write about the intersection of geopolitics and cybersecurity, and analyze breaking security and surveillance stories. Contact me at zakd@me.com. Zak developers spy-ware.
- chvid 6y ago
  This is some guy ... Here is his twitter feed: https://twitter.com/UKZak https://twitter.com/UKZak Pinned tweeet: China Has Weaponized The Smartphone: Here’s Why You Should Be Concerned And this is his company: https://www.digitalbarriers.com https://www.digitalbarriers.com With some scary looking UK police officers carrying machine guns on the front page ... Why does this guy get to write hyperbolic articles for the FT?
azinman2 6y ago
It’d be nice if someone disassembled tiktok to figure out what happens with this information. We can all speculate, tiktok can release a statement, but only the binary can give the truth for this proprietary app.
jiggawatts 6y ago
There's a good Reddit post starting with: "So I can personally weigh in on this. I reverse-engineered the app, and feel confident in stating that I have a very strong understanding for how the app operates" Ref: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news... There's also some analysis whitepapers posted here: https://penetrum.com/research https://penetrum.com/research To play devil's advocate, a lot of this might be overblown. Chat apps like this have to battle fake accounts, spammers, and API scraping of all sorts. This is typically implemented via fingerprinting the mobile devices in a way that is difficult to fake or emulate. You'd want to do this by collecting as much data as possible, and also obfuscating the method with which it is done. However, obviously, this can be done moderately securely, by hashing the inputs with something like SHA512 prior to forwarding them on to the central servers. So a lot of the outrage may be valid, but mis-directed. You don't have to be spying on purpose, it's enough to add anti-spoofing features into your app and be sloppy about it. You'd still want to keep your methods secret, and you certainly wouldn't want to own up to sloppy work. Combine the incompetence, secrecy, and the face-saving culture of asians, and you end up with something that at first glance looks like spying, because it kinda-sorta is.
deepGem 6y ago
"The most acute issue with this vulnerability is Apple’s universal clipboard functionality, which means that anything I copy on my Mac or iPad can be read by my iPhone, and vice versa. So, if TikTok is active on your phone while you work, the app can basically read anything and everything you copy on another device: Passwords, work documents, sensitive emails, financial information. Anything." Ok, with such a vulnerability, I wonder how Apple has let all these apps snoop on clipboard data for so long. They go after Hey like right away, and they have let such a gaping security hole slide through for such a long time.
- mindfulhack 6y ago
  Apple are definitely doing some good things. In Catalina they revealed to me that Backup and sync from Google.app was spying on my Downloads folder on my Mac - something it has no business doing, and which I never intended to be happening on my computer. macOS now prompts for permission when an app tries to read a major directory area without you directing first asking it to. But Apple are a corporation. They only do enough privacy things to support their particular business model. That explains their baffling inconsistencies. Ultimately, Apple can't be trusted if you truly value your privacy. I'm planning a move to Linux, which is easier than ever to use these days. Linux Mint, Elementary OS, Ubuntu...it's lookin' good.
johnny4love 6y ago
Do you suspect your husband or wife is cheating or having a side affair reach out to certifiedglobalhacker@gmalcom he helped clone my now ex wife phone and got me easy and very smooth access to all calls pictures videos messages locations on her phone. With his help I was able to get enough evidence to file a divorce don't miss out on this competent and professional expert

94 points by dsr12 6y ago

According to what I learned from friends who work at tiktok, the parent company are planning to formally sever the business tie with tiktok. Although the technology team is assumed to still share the same infrastructure (networking storage compute etc.). I never was a web or mobile app developer and my friends are not either, and I never used tiktok so have no idea how the client side technology going to be structure. PS: Tiktok and the purely algorithm driven content consumption is absolutely going to be a super mind washing machine that I will never going to touch, and will teach my kids to stay away as well.

vulcan01 6y ago
> absolutely going to be a super mind washing machine Perhaps; your greater worry should be that kids are prioritising TikTok over other, more important things (like school/sleep) > will teach my kids to stay away as well Good luck; it's going to be hard, especially when all their friends will be using it. (Source: I'm a high schooler ;) ) Perhaps an easier path is to teach them to avoid all/most social media. That's what my dad told me to do, and to date I find it a lot easier to say "I'm not on any social media" than "I'm not on TikTok" to my friends. (HN arguably is social media though...)
- bosswipe 6y ago
  HN may be social media, and it can be addictive. But the real crack are infinite scrolling algorithmic feeds optimized for engagement. HN doesn't have one of those.
jeffbee 6y ago
That's an interesting claim. TikTok has been recruiting rapidly in America, and they structure their offers mostly in terms of their non-fungible funny money, marked to a fantastic valuation (I think they told me Bytedance was worth $300bn or something preposterous). I wonder how they would pay out in a severance of TikTok from the parent company.
- justinclift 6y ago
  > they structure their offers mostly in terms of their non-fungible funny money Any more info on that? From memory of previous discussion on HN, all shares/options/similar in mainland Chinese companies are (I think?) worthless to foreigners? With something about people only finding that out the hard way when they tried to cash them in.
  - chvid 6y ago
    Tiktok will ipo on an American exchange and effectively become an American company. The proceeds of the ipo will go to bytedance who will also continue to own and run the Chinese version.
    - justinclift 6y ago
      Ahhh, that makes more sense then. Thanks. :)
ikeyany 6y ago
Don't algorithms dictate what content shows up on HN?
- TheSpiceIsLife 6y ago
  Not all algorithms are created equal.
- rapsey 6y ago
  HN is quite heavily moderated. So is TikTok (much more so).
- justicezyx 6y ago
  Really? I always assumed HN just operate on user voting. And the first batch showing on front-page is handed picked, which I think it's necessary...

vulcan01 6y ago

Previous discussion: https://news.ycombinator.com/item?id=23634138 https://news.ycombinator.com/item?id=23634138

personjerry 6y ago

They also caught like 20 other popular apps doing the same thing including NYTimes, Google News, and even Google Chrome. Instead of highlighting all of those, the article chooses to play on the "evil chinese" theme, for more sensationalist headlines. Appalling, in my opinion.

fouc 6y ago
Yup. No one upvote this article because it's clickbait
bobobob420 6y ago
"evil chinese theme" LOL. It is much more dangerous for the Chinese government to have access to more data on users than NYT or other corporations. In the previously article written by the author he says "TikTok stands out, though, given its much wider security concerns." "Sensationalist Headline". Headline of article: "Beware If You Use TikTok On Your iPhone: Here’s Why You Should Now Worry—New Security Report". Much wow, so much sensationalism in this title. Snooping for passwords and personal data on the clipboard, I guess we should not worry about TikTok. That is why the DOD banned it's use on their bases, they banned all other apps right?
- deanCommie 6y ago
  > LOL. It is much more dangerous for the Chinese government to have access to more data on users than NYT or other corporations. 20 years ago this would have been a no-brainer statement. 5 years ago you'd say "Well, yes, through PRISM and many other NSA problems, if a private US corporation has your data, so does the US government. But don't worry, the Government doesn't care about individual citizens, and wouldn't use that maliciously." In 2020, do you really think that the Trump administration would have any qualms about using any NSA data against their "enemies" (which includes Journalists not bending to the spin of the administration?) Honestly, the only reason I think it hasn't been done yet is Trump is too stupid to realize all the tools available to his disposal. If you're a Chinese citizen, you should be more afraid of the Chinese Government, yes. If you're a US citizen, you should be much much more afraid of the US government. And as a citizen of neither, I'm afraid of both equally.

reactspa 6y ago

What I find odd: - why was iOS allowing it in the first place? - why does an app have access to the clipboard unless copy/paste is deliberately invoked from within the app by the user? (my clipboard often contains highly sensitive info)

pat2man 6y ago
Probably for performance reasons. If I copy an image I want it to paste immediately.
statictype 6y ago
There are good reasons for enabling an api for copying to the clipboard. A password manager should be able to copy passwords to the clipboard without the user having to select the plain text password in a text field. Not sure about pasting.
- TheSpiceIsLife 6y ago
  > A password manager Should have a dedicated API to transmit passwords to password fields. Or, more broadly, if I had half a brain I’d get in to digital security research, so much low hanging fruit!
  - novok 6y ago
    There is a dedicated password api system, but sometimes, you just run into apps or websites that don't integrated with that API well.
kstrauser 6y ago
There are legitimate user-centric reasons for doing this: - I have an app, Parcel, that upon launch sees if I have something resembling a tracking number in my clipboard. If I do, it asks if I want to track that package. - A popular Reddit client, Apollo, looks for Reddit URLs in the clipboard. If it finds one, it asks if you want to open that conversation in the app. Sure, both of those apps work fine without that feature. Those are definitely nice conveniences, though, and they’re designed to make my life as the user just a little easier. So, there are genuinely useful reasons for an app to do this. There’s zero legit reason for TikTok to check every 30 seconds that don’t involve spyware. I want a dialog box: “Allow this app to access your clipboard?”, just like you get for access to location services, photos, the camera and mic, etc. Then I can let well-behaved apps do that for my benefit, and can tell creeper apps like TikTok to mind their own damn business.

justinclift 6y ago

> The most acute issue with this vulnerability is Apple’s universal clipboard functionality, which means that anything I copy on my Mac or iPad can be read by my iPhone, and vice versa. Didn't know that was a thing. What an extraordinary security hole that is, and excellent MiTM password catching opportunity for Apple. Does anyone know if it can be disabled programmatically? Otherwise LastPass (etc) are effectively getting backed up directly by Apple. :(

ThePowerOfFuet 6y ago
Why are you even putting passwords in the clipboard? On iOS and macOS passwords can (and should!) be filled by password manager extensions, which don't use the clipboard.
- theklr 6y ago
  Unfortunately there’s still “trash” apps that don’t utilize the feature. I wish Apple pushed on this as much as they did with their sign with Apple policy.
- 0x262d 6y ago
  they don't always work well.
- jedberg 6y ago
  Sometimes you have to copy/paste your password for some apps. Quite often on the iPhone.
- justinclift 6y ago
  That's probably a good point, for those. :) There are systems which use passwords stored locally (encrypted) though, and use cut-n-paste from the displayed password into the appropriate field. This "Apple universal clipboard" functionality sounds incredibly dangerous for things like that, if it can't be disabled. That being said, I haven't personally used macOS much in years, apart from keeping a project build server ticking over. So, this doesn't affect me personally that I know of. ;)
6y ago

newbie578 6y ago

I wonder if Apple would dare apply it's policies in this case? Flagging TikTok and angering motherland China? Who are we kidding, of course they won't, Apple are one of the most pro-china american companies.

TheSpiceIsLife 6y ago

The last paragraph: > All iPhone users should update to the latest version of TikTok as soon as it’s released—and given it is actively reading your clipboard, you might want to bear that in mind while using the app ahead of that update. Is immediately followed by this bit about the author of the article: Zak Doffman I am the Founder/CEO of Digital Barriers—developing advanced surveillance solutions for defence, national security and counter-terrorism. I write about the intersection of geopolitics and cybersecurity, and analyze breaking security and surveillance stories. Contact me at zakd@me.com. Zak developers spy-ware.

chvid 6y ago
This is some guy ... Here is his twitter feed: https://twitter.com/UKZak https://twitter.com/UKZak Pinned tweeet: China Has Weaponized The Smartphone: Here’s Why You Should Be Concerned And this is his company: https://www.digitalbarriers.com https://www.digitalbarriers.com With some scary looking UK police officers carrying machine guns on the front page ... Why does this guy get to write hyperbolic articles for the FT?

azinman2 6y ago

It’d be nice if someone disassembled tiktok to figure out what happens with this information. We can all speculate, tiktok can release a statement, but only the binary can give the truth for this proprietary app.

jiggawatts 6y ago

There's a good Reddit post starting with: "So I can personally weigh in on this. I reverse-engineered the app, and feel confident in stating that I have a very strong understanding for how the app operates" Ref: https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news... There's also some analysis whitepapers posted here: https://penetrum.com/research https://penetrum.com/research To play devil's advocate, a lot of this might be overblown. Chat apps like this have to battle fake accounts, spammers, and API scraping of all sorts. This is typically implemented via fingerprinting the mobile devices in a way that is difficult to fake or emulate. You'd want to do this by collecting as much data as possible, and also obfuscating the method with which it is done. However, obviously, this can be done moderately securely, by hashing the inputs with something like SHA512 prior to forwarding them on to the central servers. So a lot of the outrage may be valid, but mis-directed. You don't have to be spying on purpose, it's enough to add anti-spoofing features into your app and be sloppy about it. You'd still want to keep your methods secret, and you certainly wouldn't want to own up to sloppy work. Combine the incompetence, secrecy, and the face-saving culture of asians, and you end up with something that at first glance looks like spying, because it kinda-sorta is.

deepGem 6y ago

"The most acute issue with this vulnerability is Apple’s universal clipboard functionality, which means that anything I copy on my Mac or iPad can be read by my iPhone, and vice versa. So, if TikTok is active on your phone while you work, the app can basically read anything and everything you copy on another device: Passwords, work documents, sensitive emails, financial information. Anything." Ok, with such a vulnerability, I wonder how Apple has let all these apps snoop on clipboard data for so long. They go after Hey like right away, and they have let such a gaping security hole slide through for such a long time.

mindfulhack 6y ago
Apple are definitely doing some good things. In Catalina they revealed to me that Backup and sync from Google.app was spying on my Downloads folder on my Mac - something it has no business doing, and which I never intended to be happening on my computer. macOS now prompts for permission when an app tries to read a major directory area without you directing first asking it to. But Apple are a corporation. They only do enough privacy things to support their particular business model. That explains their baffling inconsistencies. Ultimately, Apple can't be trusted if you truly value your privacy. I'm planning a move to Linux, which is easier than ever to use these days. Linux Mint, Elementary OS, Ubuntu...it's lookin' good.

johnny4love 6y ago

Do you suspect your husband or wife is cheating or having a side affair reach out to certifiedglobalhacker@gmalcom he helped clone my now ex wife phone and got me easy and very smooth access to all calls pictures videos messages locations on her phone. With his help I was able to get enough evidence to file a divorce don't miss out on this competent and professional expert