Vulnerabilities found in video sharing app TikTok

One of the most popular social media app, TikTok had serious vulnerabilities that would have allowed hackers to manipulate user data and reveal personal information. It has been revealed in a research published by CheckPoint.

The vulnerabilities could have allowed attackers to manipulate with user accounts and expose personal data including names, email addresses and dates of birth.

The video sharing app has been downloaded by over a billion Android and iPhone users around the world. It is most popular among the teens.  

Check Point has joined hands with TikTok and the cyber security company has fix all the vulnerabilities. CheckPoint ensured that no vulnerabilities can now be used by hackers but it is not sure that if the security loopholes have been exploited earlier.     

One of the vulnerabilities that researchers uncovered was in the SMS functionality of the TikTok app. To help users install the application, the website allows them to send a text message to themselves with a link to download it. However, it was found that attackers could exploit this for malicious purposes.

Another vulnerability that the researchers found is in TikTok Ads subdomain of the official TikTok website which was vulnerable to Cross-Site Scripting (XSS) attacks, allowing attackers to inject malicious scripts that could target users via a trusted domain.

By combining these, it is possible for the attacker to manipulate the victim's TikTok account. They could delete videos, they could make private videos public or post their own videos.

However, account manipulation isn't the only potential risk of the vulnerabilities as researchers found it to be possible to combine the SMS and XSS vulnerabilities to retrieve sensitive information not meant for public consumption, including their name, email address and date of birth.

After the vulnerabilities got uncovered late last year by Check Point to TikTok's Chinese parent company ByteDance, who worked quickly and deployed an update to fix the security loopho