27 ms·
Guy Who Reverse-Engineered TikTok Reveals the Scary Things He Learned
- RantyDave 6y agoSo, TikTok on my (Android) phone has a grand total of zero permissions. And even if it is able to download and run some code, isn't it running in a sandbox? I don't really understand the panic here...
- BeatLeJuce 6y agoWhile the app might not be able to harm your phone, your grandma or daughter might not be as tech savvy and grant permissions more freely. Also, even though sandboxed, if you can download and run u known code on the devices of billions of users, you have a very large phone-botnet at your disposal of you ever need it
- pietrovismara 6y agoEven if it wasn't your intention, it sounds like you're implying tech savvyness is exclusive to men...please try to be inclusive, this industry needs it so much.
- emptyfile 6y agoChina bad
- azinman2 6y agoUntil it defeats that sandbox and installs malware on your targeted phone because you’re a dissident... It wouldn’t be the first time — see NSO group and its many exploits. Here TikTok makes it even easier!
- znpy 6y ago«Sorry, this post has been removed by the moderators of r/videos.» Also, the video is unavailable on youtube.
- 22c 6y agoOP may have intended for you to read the top comment of the post https://www.reddit.com/r/videos/comments/fxgi06/not_new_news_but_tbh_if_you_have_tiktiok_just_get/fmuko1m/ https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
- greatjack613 6y agoNot surprised at all, Tik Tok has clear ties to china and with all things china comes the governments control. chances are china was using Tik Tok as a global surveillance tool.
- johannes1234321 6y agoAnd everything from the U.S. comes with prism and national security letters.
- greatjack613 6y agoValid point, but I prefer a democratic govt spying on me then a totalitarian govt with world conquer ambitions, and a history of suppressing minorities
- lukaa 6y agoBut just to play devils advocate: It is highly likely that China have spies in Google and Facebook and probably USA have spies in Tik Tok and other big Chinese companies so both China and USA no matter what sw you use already know everything about you. My best argument would be: We can't allow that authoritarian country become tech superior because that will make China economically stronger than USA and than politically which will result in destruction of democracies around world.
- giancarlostoro 6y agoI would be surprised if nobody within Google and co noticed data being siphoned out to China from its internal networks.
- chii 6y agowell they wouldn't be very good spies if that happened. Look at how good russian spies were at infiltrating the gov't : https://en.wikipedia.org/wiki/Cambridge_Five https://en.wikipedia.org/wiki/Cambridge_Five , and tell me that china couldn't do the same or better.
- mdrabla 6y agoHere's a mirror of the video (from the OP of that thread): http://www.youtube.com/watch?v=I_fyz5rOwFc http://www.youtube.com/watch?v=I_fyz5rOwFc
- creato 6y agoI don't doubt at all that TikTok is super shady, but > I'm getting a lot of DM's asking me to prove the majority of this with a paper and snippets of the offending code. I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. I have some frida scripts that I pushed to my git server as well as some markdown files + conversation logs I've had with exploit devs, but not much else. In order to get everyone the proof they require, I'll likely need to reverse the app all over again which isn't something I have time for right now. Just sounds like "my dog at my homework".
- lerax 6y agoErg.... he write this and sounds a very stupid lie, but I wish that be true. TikTok is so annoying, having motivation to people use it less is better.
- TheSpiceIsLife 6y agoMy 2013 MacBook Pro Retina recently died too, but anything worth keeping or working on was stored in free-tier Dropbox, which has multi version history too. And I'm just a dumb boiler-maker / welder. It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.
- gpm 6y agoTo be honest - I know I should - but I don't either. Lots of people with technical clue's are also lazy as fuck about doing uninteresting work like setting up proper backups. Also somewhat paranoid about putting backups on other peoples infrastructure like dropbox (especially unencrypted).
- deleted 6y ago[deleted]
- cheschire 6y agoThen use cryptomator. https://cryptomator.org/ https://cryptomator.org/
- mrlala 6y agoHere's what I don't get about this.. I've seen all these various claims, and to be frank I did uninstall tiktok just recently as I only enjoyed it for about a week or so then lost interest, and there's all this stuff coming up about it.... All these claims I see sound like EVERY SINGLE APP could be doing the same thing. Are both iOS/Android really that exposed that they can just get all of this info without explicitly asking for permission? If they are bypassing shit and recording your mic under the radar.. how the hell would apple/google be letting a billion user+ app be doing this? Something just doesn't pass the smell test here.
- buran77 6y agoEvery single app could be doing the same thing. They ask for pretty broad permissions for purportedly innocent reasons but once given that access they can use it for anything they choose. This happens because even tech educated people (as you'd expect on HN) insist that they want to sacrifice privacy if it brings functionality [0]. A regular user is probably completely unaware that this could even be a problem. From their perspective they're just getting cool features for free. [0] https://news.ycombinator.com/item?id=23678303 https://news.ycombinator.com/item?id=23678303
- Thorrez 6y ago2 days ago: https://news.ycombinator.com/item?id=23665084 https://news.ycombinator.com/item?id=23665084 4 days ago: https://news.ycombinator.com/item?id=23638129 https://news.ycombinator.com/item?id=23638129
- wslh 6y agoShow me the reversed code... and show your work in reversing FB, WP, IG. This is how security works you need to show actual reversing.
- leptoniscool 6y agoExtraordinary claims require extraordinary proof.
- PurpleRamen 6y agoHow are those claims are extraordinary? It's stuff that all apps are doing to some degree.
- tragiclos 6y agoWhat makes this so much more objectionable than the myriad ad tracking networks on most web pages?
- est 6y agoDisclosure: am a dev working in the MCN business. The "private data" the app collected, is used, for most part, fingerprint the unique user. In every MCN app, there was a huge fake user problem. If an app collect zero identifiable fingerprint, then a spammer can easily fake millions of views and manipulate ranked content. The app developers are asked think clever to collect every piece of info they can, while spammers spent night and days spoof every parameter in a virtual machine or even on a matrix of remote controlled real phones. For example, if a iPhone 11 user logs in, but only with screen resolution of 320x240, is it legit? I have caught tens of thousands of fake users with simple checks like this. However the tricks expires pretty quickly, you have to move on with new feature checks, together with decision trees and bayesian networks. Some of the fingerprint collecting SDKs are even using native code to check some ARM specific instructions to tell if the device is fake or not. The parameters check had to be done in every important API calls, or spammers can easily pretend be good citizen during parameter checking process and swap the session to a cheaper VM/phone or spam the targeted API with scripts. Chinese companies all have their own team dealing with frauds or spamming on daily basis, the same way as everything can be faked in China. Think cyber attacks from Chinese IPs are bad? Now imagine doing business in China and all users of your product are bots, what methods do you have to filter out the real human users? Good luck. Many ads network SDKs are collecting user data in the same way. Otherwise it's easy to spoof fake clicks and page views. I not stating if it's the right or wrong thing to do, I am just saying it's how things are done in current state of business.
- tgsovlerkhgsel 6y ago"Other apps you have installed" is also extremely revealing about the user's interests and thus very valuable for ad serving. And equally privacy invasive. Think about pregnancy tracker or religious scripture apps. The OS should not expose this data within the sandbox of other apps by a different developer.
- est 6y ago> "Other apps you have installed" is also extremely revealing about the user's interests Yes, ads SDK across different apps can provide detailed aggregated information. Also apps promote each other, the "channel distribution" is huge business and relies on apps acknowledge each other. I highly doubt many of the Tiktok reverse-engineering result may turn out to be some thirdparty ads or anti-fraud SDKs which Chinese companies use often.
- dancemethis 6y agoImagine when it's done with Discord.
- jb775 6y agoSo is the primary concern about the lengths TikTok goes to scrape user data? Or more-so that it's a Chinese company scraping user data? I'd assume apps like fb/twitter/snapchat/etc scrape just as much. And since the US gov basically forces them to install backdoors, isn't that worse than this whole TikTok privacy conversation? Maybe I'm missing something though.
- anjbe 6y ago> I'd assume apps like fb/twitter/snapchat/etc scrape just as much. The author claims otherwise: “For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.”
- searchableguy 6y agoI said this before on the previous thread. Without knowing the author's background, you can't trust his claim. Either he provides reproducible evidence or has something backing up his claims.
- catsarebetter 6y agoObligatory "Tik Tok is a poison on society" post
- chrischen 6y agoThis guy's comment (prosound2000) pretty much tells it like it is: > The problem here is Facebook, Instagram and Twitter are US based companies that are beholden to the government. While sure you have lobbying going on, they are ultimately separate from the government, and if are found in violation of certain laws will be prosecuted or at least brought in front of congress and can face stiff penalties in the US. TikTok IS the Chinese government. They are beholden to no one. They can't break the law since they are the law. Well, he almost has it figured out. We are all actually beholden to our governments. Even Apple allegedly held off on iCloud encryption because of FBI pressure, not to mention constant right-wing efforts to destroy encryption and force companies to insert backdoors. China has a stronger central authority (therefore easier to force companies to do things), but the US is itching to go that route as well. Fighting it means preserving an actual ideological backbone, rather than simply consolidate all power to destroy our enemies. If we lose our sights on encryption, separation of our corporate entities from our government, then we are just China but in a different location.
- namelosw 6y agoThere has been a lot of bash on TikTok recently. TikTok is by no means good, but I'm yet to see it proofed much worse than counterparts from Western companies. A lot of videos and articles make me feels more like pure anti-China sentiments, just like many similar campaigns did to Huawei last year. It's fine call out the risk in terms of personal privacy, or national security. It's also fine to have and express anti-China sentiments, since everyone has his/her own opinions. But it annoys me there are a lot of people charging with only assumptions, or play double standards just to make every Chinese business or Chinese person looks evil. It's just hypocritical.
- fragsworth 6y agoYou sound a bit too defensive, the original poster didn't mention anything about China. Similar things have been said about Facebook for ages, but it's beating a dead horse now. We all know Facebook collects everything.
- jml7c5 6y agoI don't think they're off the mark with linking the reckless exuberance about this post to anti-China sentiment. Distrust and outright hostility has grown substantially over the past 18 months, particularly on reddit. It's a mix of anger at Hong Kong protests/crackdown, fears of espionage (particularly involving Huawei), and mistrust with COVID-19. There was a huge shift in reddit's demeanor (and uses of "fuck China/fuck the CPC" etc) once the Hong Kong protests got going. COVID-19 (and its associated conspiracy theories) seems to be what brought that sentiment more mainstream.
- Closi 6y agoWell in the latest iOS update it was found that they are copying all clipboard data on your device constantly (even in other apps), so that’s shady as fuck. Any user with a password manager has probably disclosed that to them.
- lilyball 6y agoWhat I saw was people talking about how lots of apps check what type of content is on the clipboard in order to adjust what they show the user (e.g. if the user has a photo on their clipboard make it easy for them to attach it). At least at the time I saw the post about this there was no evidence TikTok was actually harvesting the copied data itself. And what exactly would they want with arbitrary passwords anyway? Using them would basically destroy their business as soon as anyone figured it out, and selling them would not remotely be worth the risk.
- bllguo 6y agosurprised people are so willing to accept these claims without proof, especially here, where I imagine the number of people who could actually do the work this person claimed to is disproportionately high
- weeks 6y agoThe technical claims don't seem very far fetched. They're basically describing every banking "anti-fraud SDK" I've ever reversed.
- dathinab 6y agoUhm, video disappeared or silently geo-blocked.
- FooBarWidget 6y agoFrom a legal perspective, it seems that Tiktok is mostly (but not completely) covered. They mention these activities in their privacy statement. The statement is not clear enough on what each individual activity is used for: they put a lot of activities under an umbrella reason such as "providing tech support" and "collection for analytics partners". It doesn't make their activities right, of course. But it's debatable whether legally speaking, they are in violation of privacy laws. I think they have a higher chance of violating EU privacy laws than US ones. GDPR is quite strict: you need to have a good reason for doing something, not merely mentioning that you'll do something. I think it's also interesting to know that Tiktok's servers are in Singapore.
- nix23 6y ago>thinly-veiled as a social network I think i read that exact sentence here on HN, oh and my Dog eat all the proofs. No need to do it again ;)
- skee0083 6y agoAnnnd all the links have been removed...
- slantaclaus 6y agoMirror to video shared in post: https://youtu.be/I_fyz5rOwFc https://youtu.be/I_fyz5rOwFc
- sAbakumoff 6y ago>> I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. Isn't it an excellent sample of "the cat ate my code" excuse?
- crzydreamwalkr 6y agoThe link has been removed from both reddit and Youtube, is there any other link available to read the actual post.
- deleted 6y ago[deleted]
- bobbydreamer 6y agoIt's there a tiktok proxy app.