3 ms·
Location? Oh sweet summer child. Tiktok's Android app has been disassembled enough to tell that the built-in browser likely contains a keylogger, but also cont
by KennyBlanken 4y ago
Location? Oh sweet summer child.
Tiktok's Android app has been disassembled enough to tell that the built-in browser likely contains a keylogger, but also contains the ability to receive plaintext commands and execute them in the Java VM.
Now realize that tiktok likely has location, camera, photo, and microphone permissions.
Oh yeah, and they've been spending lots of effort on anti-virtual-machine and obfuscation techniques.
A data leak at Alibaba revealed they're collecting: GPS locations, full lists of
mobile contacts, SMS logs, IMSI numbers, IMEI numbers, device models and versions, stored
app data from previous installations, and memory data.
https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysis_whitepaper.pdf https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
- babypuncher 4y agoI can't speak for Android, but on iOS it is trivial to prevent apps from getting any of this data. Remote code execution like you describe would directly violate Apple's rules. You can't gather GPS, SMS logs, or most of the other data you mention without explicit permission from the user.
- josephcsible 4y ago> Remote code execution like you describe would directly violate Apple's rules. That doesn't mean much, given that total malware sneaks through Apple's review process a lot.
- deleted 4y ago[deleted]