The Fukin Prophecy
RIP Champ
Its spyware...I fukks with WeChat tho
The fact that the app is very clean and not bloated with bullshyt made it worth a download.
TikTok can burn in hell tho
Records everything on your phone...
Us banning tiktok and wechat on sunday
- Thread starter MikelArteta
- Start date
Records everything on your phone...
U.S phones are locked down, especially the android phones sold by carriers.. they pretty much all have locked bootloaders ensuring that users can't modify them and can't root/adminstrative control over their phones which would allow them to install or remove system processes.
I AM WE ARE
Banned
Thank you 
Ask yourself how did the world leaders allowed this to happen.
More than 50 years ago china was a rather poor centralized country, now they running shyt. And most of the major companies got so much money made in china they won't do shyt about it.
You can ban tik tok and other spyware chinese apps, 10 more apps will show up.
Even worse than that plenty of anti virus and VPN apps have data leaks and sell data to customers. Like nordVPN, Avast, and so on.
More than 50 years ago china was a rather poor centralized country, now they running shyt. And most of the major companies got so much money made in china they won't do shyt about it.
You can ban tik tok and other spyware chinese apps, 10 more apps will show up.
Even worse than that plenty of anti virus and VPN apps have data leaks and sell data to customers. Like nordVPN, Avast, and so on.
Social media should be banned. China banned it and they’re lapping us in every industry.
china aint ban social media
, they got more users on social media then the entire U.S population alone.they banned facebook,twitter, etc because they want to be able to monitor and regulate their own facebook, twitter & etc clones
Last edited:
Penetrum_TikTok_Security_Analysis_whitepaper
you've been warned
Edit: Please read to avoid confusion:
I'm getting together the data now and enlisted the help of my colleagues who were also involved in the RE process. We'll be publishing data here over the next few days: Reversing and documenting all things TikTok.. I invite any security folk who have the time to post what they've got as well - known domains and ip addresses for sysadmins to filter on, etc. I understand the app has changed quite a bit in recent versions, so my data won't be up to date.
I understand there's a lot of attention on this post right now, but please be patient.
So I can personally weigh in on this. I reverse-engineered the app, and feel confident in stating that I have a very strong understanding for how the app operates (or at least operated as of a few months ago).
TikTok is a data collection service that is thinly-veiled as a social network. If there is an API to get information on you, your contacts, or your device... well, they're using it.
On top of all of the above, they weren't even using HTTPS for the longest time. They leaked users' email addresses in their HTTP REST API, as well as their secondary emails used for password resets. Don't forget about users' real names and birthdays, too. It was allllll publicly viewable a few months ago if you MITM'd the application.
They provide users with a taste of "virality" to entice them to stay on the platform. Your first TikTok post will likely garner quite a bit of likes, regardless of how good it is.. assuming you get past the initial moderation queue if thats still a thing. Most users end up chasing the dragon. Oh, there's also a ton of creepy old men who have direct access to children on the app, and I've personally seen (and reported) some really suspect stuff. 40-50 year old men getting 8-10 year old girls to do "duets" with them with sexually suggestive songs. Those videos are posted publicly. TikTok has direct messaging functionality.
Here's the thing though.. they don't want you to know how much information they're collecting on you, and the security implications of all of that data in one place, en masse, are fukking huge. They encrypt all of the analytics requests with an algorithm that changes with every update (at the very least the keys change) just so you can't see what they're doing. They also made it so you cannot use the app at all if you block communication to their analytics host off at the DNS-level.
For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.
tl;dr; I'm a nerd who figures out how apps work for a job. Calling it an advertising platform is an understatement. TikTok is essentially malware that is targeting children. Don't use TikTok. Don't let your friends and family use it.
I'm getting together the data now and enlisted the help of my colleagues who were also involved in the RE process. We'll be publishing data here over the next few days: Reversing and documenting all things TikTok.. I invite any security folk who have the time to post what they've got as well - known domains and ip addresses for sysadmins to filter on, etc. I understand the app has changed quite a bit in recent versions, so my data won't be up to date.
I understand there's a lot of attention on this post right now, but please be patient.
So I can personally weigh in on this. I reverse-engineered the app, and feel confident in stating that I have a very strong understanding for how the app operates (or at least operated as of a few months ago).
TikTok is a data collection service that is thinly-veiled as a social network. If there is an API to get information on you, your contacts, or your device... well, they're using it.
- Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)
- Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)
- Everything network-related (ip, local ip, router mac, your mac, wifi access point name)
- Whether or not you're rooted/jailbroken
- Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC
- They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication
On top of all of the above, they weren't even using HTTPS for the longest time. They leaked users' email addresses in their HTTP REST API, as well as their secondary emails used for password resets. Don't forget about users' real names and birthdays, too. It was allllll publicly viewable a few months ago if you MITM'd the application.
They provide users with a taste of "virality" to entice them to stay on the platform. Your first TikTok post will likely garner quite a bit of likes, regardless of how good it is.. assuming you get past the initial moderation queue if thats still a thing. Most users end up chasing the dragon. Oh, there's also a ton of creepy old men who have direct access to children on the app, and I've personally seen (and reported) some really suspect stuff. 40-50 year old men getting 8-10 year old girls to do "duets" with them with sexually suggestive songs. Those videos are posted publicly. TikTok has direct messaging functionality.
Here's the thing though.. they don't want you to know how much information they're collecting on you, and the security implications of all of that data in one place, en masse, are fukking huge. They encrypt all of the analytics requests with an algorithm that changes with every update (at the very least the keys change) just so you can't see what they're doing. They also made it so you cannot use the app at all if you block communication to their analytics host off at the DNS-level.
For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.
tl;dr; I'm a nerd who figures out how apps work for a job. Calling it an advertising platform is an understatement. TikTok is essentially malware that is targeting children. Don't use TikTok. Don't let your friends and family use it.
The Fukin Prophecy
RIP Champ
No one should have to tell you...
If its Chinese you should always assume its spyware because 90% of their apps are...
maybe this will get millennials to show up at the polls 
Penetrum_TikTok_Security_Analysis_whitepaper
you've been warned
Edit: Please read to avoid confusion:
I'm getting together the data now and enlisted the help of my colleagues who were also involved in the RE process. We'll be publishing data here over the next few days: Reversing and documenting all things TikTok.. I invite any security folk who have the time to post what they've got as well - known domains and ip addresses for sysadmins to filter on, etc. I understand the app has changed quite a bit in recent versions, so my data won't be up to date.
I understand there's a lot of attention on this post right now, but please be patient.
So I can personally weigh in on this. I reverse-engineered the app, and feel confident in stating that I have a very strong understanding for how the app operates (or at least operated as of a few months ago).
TikTok is a data collection service that is thinly-veiled as a social network. If there is an API to get information on you, your contacts, or your device... well, they're using it.
The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their native libraries (have fun reading all of that assembly, assuming you can get past their customized fork of OLLVM!!!) and manually inspect every single obfuscated function. They have several different protections in place to prevent you from reversing or debugging the app as well. App behavior changes slightly if they know you're trying to figure out what they're doing. There's also a few snippets of code on the Android version that allows for the downloading of a remote zip file, unzipping it, and executing said binary. There is zero reason a mobile app would need this functionality legitimately.
- Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)
- Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)
- Everything network-related (ip, local ip, router mac, your mac, wifi access point name)
- Whether or not you're rooted/jailbroken
- Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC
- They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication
On top of all of the above, they weren't even using HTTPS for the longest time. They leaked users' email addresses in their HTTP REST API, as well as their secondary emails used for password resets. Don't forget about users' real names and birthdays, too. It was allllll publicly viewable a few months ago if you MITM'd the application.
They provide users with a taste of "virality" to entice them to stay on the platform. Your first TikTok post will likely garner quite a bit of likes, regardless of how good it is.. assuming you get past the initial moderation queue if thats still a thing. Most users end up chasing the dragon. Oh, there's also a ton of creepy old men who have direct access to children on the app, and I've personally seen (and reported) some really suspect stuff. 40-50 year old men getting 8-10 year old girls to do "duets" with them with sexually suggestive songs. Those videos are posted publicly. TikTok has direct messaging functionality.
Here's the thing though.. they don't want you to know how much information they're collecting on you, and the security implications of all of that data in one place, en masse, are fukking huge. They encrypt all of the analytics requests with an algorithm that changes with every update (at the very least the keys change) just so you can't see what they're doing. They also made it so you cannot use the app at all if you block communication to their analytics host off at the DNS-level.
For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.
tl;dr; I'm a nerd who figures out how apps work for a job. Calling it an advertising platform is an understatement. TikTok is essentially malware that is targeting children. Don't use TikTok. Don't let your friends and family use it.
You can warn them all you want the typical answer casuals say is "I got nothing to hide, why should I care"
Its how we got to this point where all these smart devices collect way too much info, because "no one has nothing to hide"
But @ the same time, fukk all them lil white kids getting paid to be parodies of black creatives. Tik Tok has been known to have racist ass algorithms too. So fukk em.
If we being real, 80 percent of apps off the Google Play store is filled with spyware/malware. YouTube is a haven for the shyt with their suggestions. IG with the ads that seem crazy familiar with what you are saying and the actions you are doing. FB you already know what it is.Despite the fact that China does get a bad rep when it comes down to their apps and etc, America should not be exempt from the same ordeal, it's just different strokes with the data usage.
