5 ms·

Why am I not surprised?

rvz 4y ago
Yeah, it is unsurprising since even another security researcher knew that all of TikTok's user data is being harvested on Alibaba Cloud which that already got breached resulting in a 900GB file being dumped somewhere as they collect the IMEI numbers of many users as found in the Android app. From [0] > We at Penetrum believe that everyone should have the right to know what data is being harvested by companies and would like to give our readers a clearer understanding of what happens when you download the mobile application TikTok. From our understanding and our analysis it seems that TikTok does an excessive amount of tracking on it’s users, and that the data collected is partially if not fully stored on Chinese servers with the ISP Alibaba. For it to happen again. Hardly shocking and very expected. But as always the TikTok fans rushing here, panicking will do anything to deny the breach and after examining the contents, sample(s) of the breach, it looks highly legit. [0] https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
- prvit 4y ago
  Did you actually read what you linked? Alibaba cloud wasn't breached, one of the tens of thousands of Alibaba cloud customers had a database exposed to the internet. Same happens with AWS and Azure all the time.
  - rvz 4y ago
    > Did you actually read what you linked? I hope you read the guidelines: "Please don't comment on whether someone read an article." [0] > one of the tens of thousands of Alibaba cloud customers had a database exposed to the internet. Was exposed ON Alibaba Cloud and that database WAS breached. It really doesn't matter and there is little difference in that event or whatever the security researcher and I meant. I'm assuming you must have read this before commenting: [1] "We provide ongoing security guidelines and training to all our customers, and always advise them to protect their data by setting a secure password among other security recommendations,” an Alibaba spokesperson stated."* Either way, if that is not a breach then I don't know what is. [0] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html [1] https://www.breakingasia.com/news/china-alibaba-shut-down-server-after-data-leak/ https://www.breakingasia.com/news/china-alibaba-shut-down-se...
    - ammo1662 4y ago
      They just host your servers, not own your servers. Check [0]. They could give you recommendations, but they cannot stop you from killing yourself. > It really doesn't matter and there is little difference in that event or whatever the security researcher and I meant. It does matter. If you setup an unprotected server on AWS and someone hacked it. It is your fault, not AWS. [0] https://en.wikipedia.org/wiki/Infrastructure_as_a_service https://en.wikipedia.org/wiki/Infrastructure_as_a_service
      - rvz 4y ago
        You have misread the point of my comment. I already know it is a breach, the GP commenter was hairsplitting and the difference in my comment is negligible and is the same as what the security researcher and the statement of the breach was. > It does matter. If you setup an unprotected server on AWS and someone hacked it. It is your fault, not AWS. Indeed it does matter. Whoever owns the server got breached and that is that. But I didn't say the breach didn't matter. I said the difference in where it got breached doesn't matter.
    - prvit 4y ago
      A random Alibaba Cloud customer got breached. You tried to make it sound like Alibaba Cloud was breached. In reality this has nothing to do with either Alibaba Cloud nor Tiktok.

rvz 4y ago

Yeah, it is unsurprising since even another security researcher knew that all of TikTok's user data is being harvested on Alibaba Cloud which that already got breached resulting in a 900GB file being dumped somewhere as they collect the IMEI numbers of many users as found in the Android app. From [0] > We at Penetrum believe that everyone should have the right to know what data is being harvested by companies and would like to give our readers a clearer understanding of what happens when you download the mobile application TikTok. From our understanding and our analysis it seems that TikTok does an excessive amount of tracking on it’s users, and that the data collected is partially if not fully stored on Chinese servers with the ISP Alibaba. For it to happen again. Hardly shocking and very expected. But as always the TikTok fans rushing here, panicking will do anything to deny the breach and after examining the contents, sample(s) of the breach, it looks highly legit. [0] https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...

prvit 4y ago
Did you actually read what you linked? Alibaba cloud wasn't breached, one of the tens of thousands of Alibaba cloud customers had a database exposed to the internet. Same happens with AWS and Azure all the time.
- rvz 4y ago
  > Did you actually read what you linked? I hope you read the guidelines: "Please don't comment on whether someone read an article." [0] > one of the tens of thousands of Alibaba cloud customers had a database exposed to the internet. Was exposed ON Alibaba Cloud and that database WAS breached. It really doesn't matter and there is little difference in that event or whatever the security researcher and I meant. I'm assuming you must have read this before commenting: [1] "We provide ongoing security guidelines and training to all our customers, and always advise them to protect their data by setting a secure password among other security recommendations,” an Alibaba spokesperson stated."* Either way, if that is not a breach then I don't know what is. [0] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html [1] https://www.breakingasia.com/news/china-alibaba-shut-down-server-after-data-leak/ https://www.breakingasia.com/news/china-alibaba-shut-down-se...
  - ammo1662 4y ago
    They just host your servers, not own your servers. Check [0]. They could give you recommendations, but they cannot stop you from killing yourself. > It really doesn't matter and there is little difference in that event or whatever the security researcher and I meant. It does matter. If you setup an unprotected server on AWS and someone hacked it. It is your fault, not AWS. [0] https://en.wikipedia.org/wiki/Infrastructure_as_a_service https://en.wikipedia.org/wiki/Infrastructure_as_a_service
    - rvz 4y ago
      You have misread the point of my comment. I already know it is a breach, the GP commenter was hairsplitting and the difference in my comment is negligible and is the same as what the security researcher and the statement of the breach was. > It does matter. If you setup an unprotected server on AWS and someone hacked it. It is your fault, not AWS. Indeed it does matter. Whoever owns the server got breached and that is that. But I didn't say the breach didn't matter. I said the difference in where it got breached doesn't matter.
  - prvit 4y ago
    A random Alibaba Cloud customer got breached. You tried to make it sound like Alibaba Cloud was breached. In reality this has nothing to do with either Alibaba Cloud nor Tiktok.