EasyJet Hack: passenger data could be sold on dark web after major cyber attack, experts warn
Criminals could also keep the data – which includes credit card information – to issue ransoms or use in organised crime.
Researchers at security firm Check Point found multiple issues, all ripe for exploitation by hackers. It informed ByteDance of the problems in November.
TikTok said they were fixed and thanked the security firm for alerting them.
"Like many organisations, we encourage responsible security researchers to privately disclose zero-day vulnerabilities to us," it said in a statement.
"Before public disclosure, Check Point agreed that all reported issues were patched in the latest version of our app. We hope that this successful resolution will encourage further collaboration with security researchers."
A zero-day vulnerability refers to a security flaw that has not been previously disclosed.
Check Point added that the vulnerability was in place for most of 2019, and said this raised "serious questions" about whether any hacker had discovered it.
It said that ByteDance had "responsibly deployed" a solution within a month of it being told about the problem.
Much of the issue lay in the way that TikTok handled users' mobile phone numbers, which people must provide when they register for the app.
Check Point discovered that hackers could access these numbers and send texts on behalf of TikTok. In turn that allowed a hacker to:
- delete videos, change settings on them from private to public or upload unauthorised videos
- force a TikTok user on to a web server controlled by the hacker, making it possible for the attacker to send unwanted requests on behalf of the user
- Redirect users to a malicious website masquerading as TikTok
Last week the US military told its personnel not to use the Chinese-owned app on government-issued phones, because of security concerns and fears over possible links to the Chinese government.
Initially popular in Asian countries, the short video creation platform has experienced huge growth in recent years and now has 1.5 billion downloads.
https://www.bbc.co.uk/news/technology-51010408?intlink_from_url=https://www.bbc.co.uk/news/topics/cz4pr2gd85qt/cyber-security&link_location=live-reporting-story
