There was a TikTok Android app exploit that let hackers hijack accounts with one click
Don't freak out, as it's long resolved now, but Android users should really think twice before clicking any links in the TikTok app after security flaws were found and reported that made it ridiculously easy to steal others accounts with a simple link. While it's been addressed for now, it's always good internet security advice to not go clicking unknown links and with an exploit this simple it's a good idea to be ever vigilant out there.
According to BleepingComputer,(opens in new tab) Microsoft reported the flaw to TikTok back in February but given the potential severity, it's not too surprising we aren't hearing about it until now. With a well crafted malicious link, reportedly more than 70 JavaScript methods could be used to get access to the app's webview, only used by the Android app.
From there, those with malicious intent can wreak all sorts of havoc on the users' account. They can modify and view basically all the data, including profile settings and private videos. Due to the ability to perform authenticated requests through the webview, it's by no means a stretch to say they could completely take over the account.
«Attackers could have leveraged the vulnerability to hijack an account without users' awareness if a targeted user simply clicked a specially crafted link,» Microsoft 365 Defender Research Team(opens in new tab)'s Dimitrios Valsamaras said, adding «Attackers could have then accessed and modified users' TikTok profiles and sensitive information, such as by publicizing private videos, sending messages, and uploading videos on behalf of users.»
How to buy a graphics card(opens in new tab): tips on buying a graphics card in the barren silicon landscape that is 2021
The surprising, yet good news is it
Read more on pcgamer.com
