6 ms·

Tell HN: Chinese TikTok is the most privacy invasive app I've ever seen

46 points by schleck8 4y ago

This is about the Chinese version of Tiktok, Douyin. It's basically the same but exclusive to Mainland China. To summarize: - It immidiately attempts to access the clipboard contents after opening - It makes 140 DNS requests to atleast 5 different domains in the first three minutes after closing the app - it makes an additional 50 DNS requests 5 minutes after closing the app - it continuously makes tracking requests in the background after being closed - It requests phone and location permissions immidiately after opening Some of the domains it contacts after being closed: - pstatp.com - zijieapi.com - bytecdn.cn - snssdk.com - amemv.com - douyincdn.com This is honestly even crazier than I expected. I've never seen an app contact this many subdomains even while being in the foreground. Instagram contacts around 5 for comparison, and only while running in the foreground.

uniqueuid 4y ago
Very interesting. How did you measure this? On-device or on the wire or with MITM?
- schleck8 4y ago
  Pretty simple with DNS logging. I installed the APK (it's not georestricted, you can just install it on Android). I set up a permanent VPN killswitch while testing, set up NextDNS as private DNS provider in the system settings and changed the NextDNS settings to log all contacted domains. You can then view the DNS requests in real time As for the clipboard, newer Android versions give you a toast when something uses the clipboard API to fetch its content
  - uniqueuid 4y ago
    I think there's an evident need for someone to do a deep analysis of this app's behavior. Both with interception/MITM and possibly disassembly if that's even possible ATM. I remember trying to disassemble a facebook APK years ago and that was way too involved even then (because of countermeasures). Perhaps using frida on android is a saner approach these days.
    - schleck8 4y ago
      The same people who analyzed Pegasus did that, but Douyin obfuscates its code so a lot of activity is inconclusive https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-privacy-analysis/ https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-priv...
      - uniqueuid 4y ago
        Many thanks, the citizen lab does awesome work. Great to see this. [edit]: Awesome to see that they publish their reports on github and even include frida components https://github.com/citizenlab/tiktok-report-data https://github.com/citizenlab/tiktok-report-data
  - throwaway4good 4y ago
    Why do you interpretate a DNS request as a "privacy invasion"? To me many DNS request sounds like a broken / poorly designed app. Do you block the requests - is that reason for the large number?
    - schleck8 4y ago
      Because some of the domains mixed into the bunch, which were contacted independently from the CDN at times, are known tracking domains. Even disregarding this fact, Douyin has 700 million annual users and this issue does not exist with Tiktok which uses the same codebase. You are telling me this is not intentional but an accident? With a company as large and skilled as Bytedance?
      - throwaway4good 4y ago
        It is an app not constrained by browser same origin rules. It could just do one request sending the tracking information and the receiver could pass that on as needed. I don't think you can deduce what you deduce from the number of DNS requests it does.
        schleck8 4y ago
        It's rather about the fact that this is happening minutes after closing the app than the number, I do agree with you on the latter
    - sam0x17 4y ago
      The domains in question are very clearly analytics collectors disguised as cdns
- dyingkneepad 4y ago
  You can use Tracker Control: https://f-droid.org/en/packages/net.kollnig.missioncontrol.fdroid/ https://f-droid.org/en/packages/net.kollnig.missioncontrol.f...
fritigern 4y ago
What does TikTok do that Instagram doesn't? TikTok is a privacy nightmare, but not more so than any other social network.
- uniqueuid 4y ago
  Yeah, many platforms converge to similar methods. But only some of them are controlled by totalitarian regimes, of course.
  - fritigern 4y ago
    - uniqueuid 4y ago
      Although I can relate to the sentiment, and the history of US interventions is not one that's seen favorable today, I think that you are underestimating Xi's position right now. China has become much more oppressive internally. And if you don't care about human rights for the Chinese population, then maybe you care about the fact that the Xi regime asserts eventual control over foreign reporting [1]: “48-character policy” (48字方针), an all-dimensional vision of comprehensive control across media platforms and bridging the domestic/international frames, articulated through 12 four-character phrases. ... Party domination of the message as reflected in both domestic and international public opinion" [1] https://chinamediaproject.org/2022/05/03/developing-online-media-control/ https://chinamediaproject.org/2022/05/03/developing-online-m...
      - fritigern 4y ago
        I agree, the regime in China is nothing good. But we live in an imperfect world and they clearly are the "lesser of the many evils" our there. Just one concrete example: China didn't wage wars for 20+ years in the Middle East, resulting in millions of desperate refugees showing up on our doorstep.
        4y ago
ig-88ms 4y ago
Now do it for iOS.
Comevius 4y ago
How is this suprising? China's brand of authoritarianism (Marxism–Leninism) is based on control. The Chinese people recognize this as not just a legitimate, but effective way of doing things. They value predictability above all.
- schleck8 4y ago
  I agree on the efficiancy part but how is it legitimate? It's not legitimized by anyone but the oligarchy, normal people have zero influence on anything political.
jpl56 4y ago
Thanks, this is very interesting! When I use the TikTok website in France, from desktop, I notice my Ublock Origin blocks 30 to 40 requests per minute, this doesn't happen with any other socials. Therefore, I didn't dare installing the app on my tablet!
- knur 4y ago
  Take a look at how many things uBlock blocks when you open Slack on your browser.
- rg111 4y ago
  > this doesn't happen with any other socials This happens regularly with Discord.
radu_floricica 4y ago
Why does it matter if it's 200 subdomains, or just one packet with all the relevant info sent on the same connection that's downloading the videos? This is only weak evidence of privacy breach, and strong evidence of sloppy programming. Domain names are things like "api", "sdk", "cdn".
- xtajv 4y ago
  Bugs are just security issues.
RGamma 4y ago
You're describing "nice to have"s. The real invasion happens in the data center, away from what's measurable on the/any client.
hungrigekatze 4y ago
For folks who have already read the (great) CitizenLab report but would like more research-based literature into TikTok and/or Douyin: - Analyzing TikTok from a Digital Forensics Perspective : (Published in 2021 by some Portuguese researchers: https://iconline.ipleiria.pt/bitstream/10400.8/6263/1/jowua-v12n3-5.pdf https://iconline.ipleiria.pt/bitstream/10400.8/6263/1/jowua-... - Post-mortem digital forensic artifacts of TikTok Android App : (Published in 2020 at ARES 2020: The 15th International Conference on Availability, Reliability and Security ; authors are a lot of the authors from the Analyzing TikTok paper in the previous link): https://www.researchgate.net/publication/343856173_Post-mortem_digital_forensic_artifacts_of_TikTok_Android_App https://www.researchgate.net/publication/343856173_Post-mort...

46 points by schleck8 4y ago

uniqueuid 4y ago

Very interesting. How did you measure this? On-device or on the wire or with MITM?

schleck8 4y ago
Pretty simple with DNS logging. I installed the APK (it's not georestricted, you can just install it on Android). I set up a permanent VPN killswitch while testing, set up NextDNS as private DNS provider in the system settings and changed the NextDNS settings to log all contacted domains. You can then view the DNS requests in real time As for the clipboard, newer Android versions give you a toast when something uses the clipboard API to fetch its content
- uniqueuid 4y ago
  I think there's an evident need for someone to do a deep analysis of this app's behavior. Both with interception/MITM and possibly disassembly if that's even possible ATM. I remember trying to disassemble a facebook APK years ago and that was way too involved even then (because of countermeasures). Perhaps using frida on android is a saner approach these days.
  - schleck8 4y ago
    The same people who analyzed Pegasus did that, but Douyin obfuscates its code so a lot of activity is inconclusive https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-privacy-analysis/ https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-priv...
    - uniqueuid 4y ago
      Many thanks, the citizen lab does awesome work. Great to see this. [edit]: Awesome to see that they publish their reports on github and even include frida components https://github.com/citizenlab/tiktok-report-data https://github.com/citizenlab/tiktok-report-data
- throwaway4good 4y ago
  Why do you interpretate a DNS request as a "privacy invasion"? To me many DNS request sounds like a broken / poorly designed app. Do you block the requests - is that reason for the large number?
  - schleck8 4y ago
    Because some of the domains mixed into the bunch, which were contacted independently from the CDN at times, are known tracking domains. Even disregarding this fact, Douyin has 700 million annual users and this issue does not exist with Tiktok which uses the same codebase. You are telling me this is not intentional but an accident? With a company as large and skilled as Bytedance?
    - throwaway4good 4y ago
      It is an app not constrained by browser same origin rules. It could just do one request sending the tracking information and the receiver could pass that on as needed. I don't think you can deduce what you deduce from the number of DNS requests it does.
      - schleck8 4y ago
        It's rather about the fact that this is happening minutes after closing the app than the number, I do agree with you on the latter
  - sam0x17 4y ago
    The domains in question are very clearly analytics collectors disguised as cdns
dyingkneepad 4y ago
You can use Tracker Control: https://f-droid.org/en/packages/net.kollnig.missioncontrol.fdroid/ https://f-droid.org/en/packages/net.kollnig.missioncontrol.f...

fritigern 4y ago

What does TikTok do that Instagram doesn't? TikTok is a privacy nightmare, but not more so than any other social network.

uniqueuid 4y ago
Yeah, many platforms converge to similar methods. But only some of them are controlled by totalitarian regimes, of course.
- fritigern 4y ago
  - uniqueuid 4y ago
    Although I can relate to the sentiment, and the history of US interventions is not one that's seen favorable today, I think that you are underestimating Xi's position right now. China has become much more oppressive internally. And if you don't care about human rights for the Chinese population, then maybe you care about the fact that the Xi regime asserts eventual control over foreign reporting [1]: “48-character policy” (48字方针), an all-dimensional vision of comprehensive control across media platforms and bridging the domestic/international frames, articulated through 12 four-character phrases. ... Party domination of the message as reflected in both domestic and international public opinion" [1] https://chinamediaproject.org/2022/05/03/developing-online-media-control/ https://chinamediaproject.org/2022/05/03/developing-online-m...
    - fritigern 4y ago
      I agree, the regime in China is nothing good. But we live in an imperfect world and they clearly are the "lesser of the many evils" our there. Just one concrete example: China didn't wage wars for 20+ years in the Middle East, resulting in millions of desperate refugees showing up on our doorstep.
      - 4y ago

ig-88ms 4y ago

Now do it for iOS.

Comevius 4y ago

How is this suprising? China's brand of authoritarianism (Marxism–Leninism) is based on control. The Chinese people recognize this as not just a legitimate, but effective way of doing things. They value predictability above all.

schleck8 4y ago
I agree on the efficiancy part but how is it legitimate? It's not legitimized by anyone but the oligarchy, normal people have zero influence on anything political.

jpl56 4y ago

Thanks, this is very interesting! When I use the TikTok website in France, from desktop, I notice my Ublock Origin blocks 30 to 40 requests per minute, this doesn't happen with any other socials. Therefore, I didn't dare installing the app on my tablet!

knur 4y ago
Take a look at how many things uBlock blocks when you open Slack on your browser.
rg111 4y ago
> this doesn't happen with any other socials This happens regularly with Discord.

radu_floricica 4y ago

Why does it matter if it's 200 subdomains, or just one packet with all the relevant info sent on the same connection that's downloading the videos? This is only weak evidence of privacy breach, and strong evidence of sloppy programming. Domain names are things like "api", "sdk", "cdn".

xtajv 4y ago
Bugs are just security issues.

RGamma 4y ago

You're describing "nice to have"s. The real invasion happens in the data center, away from what's measurable on the/any client.

hungrigekatze 4y ago

For folks who have already read the (great) CitizenLab report but would like more research-based literature into TikTok and/or Douyin: - Analyzing TikTok from a Digital Forensics Perspective : (Published in 2021 by some Portuguese researchers: https://iconline.ipleiria.pt/bitstream/10400.8/6263/1/jowua-v12n3-5.pdf https://iconline.ipleiria.pt/bitstream/10400.8/6263/1/jowua-... - Post-mortem digital forensic artifacts of TikTok Android App : (Published in 2020 at ARES 2020: The 15th International Conference on Availability, Reliability and Security ; authors are a lot of the authors from the Analyzing TikTok paper in the previous link): https://www.researchgate.net/publication/343856173_Post-mortem_digital_forensic_artifacts_of_TikTok_Android_App https://www.researchgate.net/publication/343856173_Post-mort...