kedr2earth
Вероятно, это не ново, но тем не менее --
TikTok is a data collection service that is thinly-veiled as a social network. If there is an API to get information on you, your contacts, or your device... well, they're using it.
- Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)
- Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)
- Everything network-related (ip, local ip, router mac, your mac, wifi access point name)
- Whether or not you're rooted/jailbroken
- Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC
- They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication
The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their native libraries (have fun reading all of that assembly, assuming you can get past their customized fork of OLLVM!!!) and manually inspect every single obfuscated function. They have several different protections in place to prevent you from reversing or debugging the app as well. App behavior changes slightly if they know you're trying to figure out what they're doing. There's also a few snippets of code on the Android version that allows for the downloading of a remote zip file, unzipping it, and executing said binary. There is zero reason a mobile app would need this functionality legitimately.
The above Penetrum link appears to be gone. Someone else linked the paper here: https://penetrum.com/research
Zimperium put out a report awhile ago too: https://blog.zimperium.com/zimperium-analyzes-tiktoks-security-and-privacy-risks/
src
TikTok is a data collection service that is thinly-veiled as a social network. If there is an API to get information on you, your contacts, or your device... well, they're using it.
- Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)
- Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)
- Everything network-related (ip, local ip, router mac, your mac, wifi access point name)
- Whether or not you're rooted/jailbroken
- Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC
- They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication
The scariest part of all of this is that much of the logging they're doing is remotely configurable, and unless you reverse every single one of their native libraries (have fun reading all of that assembly, assuming you can get past their customized fork of OLLVM!!!) and manually inspect every single obfuscated function. They have several different protections in place to prevent you from reversing or debugging the app as well. App behavior changes slightly if they know you're trying to figure out what they're doing. There's also a few snippets of code on the Android version that allows for the downloading of a remote zip file, unzipping it, and executing said binary. There is zero reason a mobile app would need this functionality legitimately.
The above Penetrum link appears to be gone. Someone else linked the paper here: https://penetrum.com/research
Zimperium put out a report awhile ago too: https://blog.zimperium.com/zimperium-analyzes-tiktoks-security-and-privacy-risks/
src
В Сан-Хосе, неподалеку от нового комплекса Google, запланировали постройку ЖК. Все 206 квартир по 37 квадратов (400 sq ft). Американская мечта, да и только!
https://www.mercurynews.com/2020/06/25/400-square-feet-micro-apartments-coming-to-downtown-san-jose-near-google-village/
https://www.mercurynews.com/2020/06/25/400-square-feet-micro-apartments-coming-to-downtown-san-jose-near-google-village/
