3 ms·

Any discussion of intent is always going to be speculation. All we can think about is what such a thing would be capable of if it were somehow malicious. The f

by Lammy 5y ago

Any discussion of intent is always going to be speculation. All we can think about is what such a thing would be capable of if it were somehow malicious. The first possibility that comes to my mind would be sniffing Ethernet MAC addresses because it could be done without any sort of device-specific support built in to the app. Assuming your local devices’ manufacturers are following Da Rulez, the first part of their MAC address usually tells you the company, and the second part tends to be individualized/serialized. That would, for example, let TikTok derive when certain users are together IRL if they both show up scan-adjacent to a unique MAC. Or maybe it could let them derive multiple accounts belonging to a single person if one is used on VPN-only to discuss political or personal topics that person might not want associated with their IRL identity.

rafale 5y ago
Can you send packets to local network if you are using a VPN on ur phone? Sounds like a VPN bug to me.
- oefrha 5y ago
  Of course you can. Look up VPN routing / split tunneling. It’s not uncommon for corporate VPNs to only route intranet traffic for instance; and LAN is usually whitelisted.
  - MichaelGroves 5y ago
    Besides corporate VPNs, typical consumer VPNs are also set up to allow LAN access. Your average joe-smoe would be annoyed if their network printer stopped working every time they turned on their VPN to watch netflix movies or whatever.
    - oefrha 5y ago
      Yes, "LAN is usually whitelisted" in my comment is independent from the corporate split tunneling example.
    - oasisbob 5y ago
      IPSEC VPNs (and others) have the remote networks defined in the protocol as part of the security association (SA). The SAs define which networks are available over the tunnel. Saying "all RFC1918 addresses are available over here" is quite a cocky and obviously broken thing to do, unless you're dealing with a corporate device which is paranoid about leaking traffic to other networks.
sam0x17 5y ago
You can also just take the collection of devices typically on the network, hash the MAC addresses all together, and now you have a unique identifier for a household
- ALittleLight 5y ago
  But devices would join and leave the network in a household - especially phones. Maybe you could have a listening period, e.g. a week, where you build a set of witnessed devices and then hash that for a household id?
- vineyardmike 5y ago
  has the mac's and use a bloom filter, look for overlaps across time/accounts.
  - sam0x17 5y ago
    I'm overthinking it though. You'd probably get more mileage out of just looking for individual MAC addresses, full stop.
giantrobot 5y ago
If I was a state intelligence service I would love TikTok. Especially if it was legally banned in my country so was used almost exclusively by foreigners. One better was if the government had a controlling stake in the company [0] and laws requiring the company to be virtually transparent to demands from state security agencies [1]. Not only does TikTok have a ton of overt data about users but also contemporaneous data like usage patterns and physical location. Then using the app to collect and exfiltrate information about all manner of foreign networks. I can pass off that data to my government run hacking [2] groups [3] as well as regime-favored businesses for some really great market research. [0] https://finance.yahoo.com/news/bytedance-says-china-unit-holds-145610358.html https://finance.yahoo.com/news/bytedance-says-china-unit-hol... [1] https://en.m.wikipedia.org/wiki/Cybersecurity_Law_of_the_People%27s_Republic_of_China https://en.m.wikipedia.org/wiki/Cybersecurity_Law_of_the_Peo... [2] https://en.m.wikipedia.org/wiki/PLA_Unit_61398 https://en.m.wikipedia.org/wiki/PLA_Unit_61398 [3] https://en.m.wikipedia.org/wiki/PLA_Unit_61486 https://en.m.wikipedia.org/wiki/PLA_Unit_61486
- reillyse 5y ago
  The only actual issue with this setup for citizens of the US is that US citizens like to be the people with access to the data and doing the spying. What you have described, a state intelligence service with access to loads of user data that they happily use for spying is what the US has normalized. Collecting all this data is par for the course (Snowden exposed that pretty conclusively) and non US citizens have no rights as far as the US is concerned. Are they (china) doing it, probably not, seems like a lot of effort for very little gain I mean you find out that I like puppy videos and mostly stay in my house. It's a fun app though :) - also to the original person's tweet, most of the apps on my iphone pop this up from time to time, so if we are going to accuse TikTok of spying on me we should be accusing Calm and Insight Timer too (to randomly pick two).
  - giantrobot 5y ago
    AFAIK Calm and Insight don't have hundreds of millions of users nor is the CCP on their corporate boards. But with explanations provided by the apps as to why they want network device access they probably shouldn't be trusted. As for the data collection, TikTok/ByteDance is definitely going to store it. They wouldn't collect it otherwise. To the utility of the data, if they've got MAC addresses of devices on your home network they can tell many of the brands of devices you own. They know when you get a new computer even if you never use TikTok on it. If you launch the app at your office they get the same information about your office network. In aggregate their network scanning will collect vast amounts of data. The TikTok app is turning every user into a passive network scanner. Even if you want to ignore the CCP's influence on ByteDance I don't think there is any reason to give them the benefit of the doubt about their data collection. They'll sell their users and anyone around them. I have the same problem with Facebook and their damn shadow profiles and covert data collection.
dheera 5y ago
Apple is also complicit in making it incredibly hard to execute an MITM proxy to know what your iOS apps are sending back to their servers. Being able to MITM and see what your apps and OS are sending back is the first step to real privacy.

by Lammy 5y ago

rafale 5y ago

Can you send packets to local network if you are using a VPN on ur phone? Sounds like a VPN bug to me.

oefrha 5y ago
Of course you can. Look up VPN routing / split tunneling. It’s not uncommon for corporate VPNs to only route intranet traffic for instance; and LAN is usually whitelisted.
- MichaelGroves 5y ago
  Besides corporate VPNs, typical consumer VPNs are also set up to allow LAN access. Your average joe-smoe would be annoyed if their network printer stopped working every time they turned on their VPN to watch netflix movies or whatever.
  - oefrha 5y ago
    Yes, "LAN is usually whitelisted" in my comment is independent from the corporate split tunneling example.
  - oasisbob 5y ago
    IPSEC VPNs (and others) have the remote networks defined in the protocol as part of the security association (SA). The SAs define which networks are available over the tunnel. Saying "all RFC1918 addresses are available over here" is quite a cocky and obviously broken thing to do, unless you're dealing with a corporate device which is paranoid about leaking traffic to other networks.

sam0x17 5y ago

You can also just take the collection of devices typically on the network, hash the MAC addresses all together, and now you have a unique identifier for a household

ALittleLight 5y ago
But devices would join and leave the network in a household - especially phones. Maybe you could have a listening period, e.g. a week, where you build a set of witnessed devices and then hash that for a household id?
vineyardmike 5y ago
has the mac's and use a bloom filter, look for overlaps across time/accounts.
- sam0x17 5y ago
  I'm overthinking it though. You'd probably get more mileage out of just looking for individual MAC addresses, full stop.

giantrobot 5y ago

If I was a state intelligence service I would love TikTok. Especially if it was legally banned in my country so was used almost exclusively by foreigners. One better was if the government had a controlling stake in the company [0] and laws requiring the company to be virtually transparent to demands from state security agencies [1]. Not only does TikTok have a ton of overt data about users but also contemporaneous data like usage patterns and physical location. Then using the app to collect and exfiltrate information about all manner of foreign networks. I can pass off that data to my government run hacking [2] groups [3] as well as regime-favored businesses for some really great market research. [0] https://finance.yahoo.com/news/bytedance-says-china-unit-holds-145610358.html https://finance.yahoo.com/news/bytedance-says-china-unit-hol... [1] https://en.m.wikipedia.org/wiki/Cybersecurity_Law_of_the_People%27s_Republic_of_China https://en.m.wikipedia.org/wiki/Cybersecurity_Law_of_the_Peo... [2] https://en.m.wikipedia.org/wiki/PLA_Unit_61398 https://en.m.wikipedia.org/wiki/PLA_Unit_61398 [3] https://en.m.wikipedia.org/wiki/PLA_Unit_61486 https://en.m.wikipedia.org/wiki/PLA_Unit_61486

reillyse 5y ago
The only actual issue with this setup for citizens of the US is that US citizens like to be the people with access to the data and doing the spying. What you have described, a state intelligence service with access to loads of user data that they happily use for spying is what the US has normalized. Collecting all this data is par for the course (Snowden exposed that pretty conclusively) and non US citizens have no rights as far as the US is concerned. Are they (china) doing it, probably not, seems like a lot of effort for very little gain I mean you find out that I like puppy videos and mostly stay in my house. It's a fun app though :) - also to the original person's tweet, most of the apps on my iphone pop this up from time to time, so if we are going to accuse TikTok of spying on me we should be accusing Calm and Insight Timer too (to randomly pick two).
- giantrobot 5y ago
  AFAIK Calm and Insight don't have hundreds of millions of users nor is the CCP on their corporate boards. But with explanations provided by the apps as to why they want network device access they probably shouldn't be trusted. As for the data collection, TikTok/ByteDance is definitely going to store it. They wouldn't collect it otherwise. To the utility of the data, if they've got MAC addresses of devices on your home network they can tell many of the brands of devices you own. They know when you get a new computer even if you never use TikTok on it. If you launch the app at your office they get the same information about your office network. In aggregate their network scanning will collect vast amounts of data. The TikTok app is turning every user into a passive network scanner. Even if you want to ignore the CCP's influence on ByteDance I don't think there is any reason to give them the benefit of the doubt about their data collection. They'll sell their users and anyone around them. I have the same problem with Facebook and their damn shadow profiles and covert data collection.

dheera 5y ago

Apple is also complicit in making it incredibly hard to execute an MITM proxy to know what your iOS apps are sending back to their servers. Being able to MITM and see what your apps and OS are sending back is the first step to real privacy.