“The circulation of misleading and fake videos in a popular platform such as TikTok poses huge risks,” they said, on disclosing their POC. The researchers prepared some fake videos, using the newsworthy disinformation surrounding the coronavirus pandemic as their lure.
This security gap enabled the team to monitor the videos being watched by specific users or IP addresses, and, with control of a user’s access point, to mount a man in the middle attack “to alter the downloaded content.” However, this should be the exception rather than the rule, and most apps have made the transition to HTTPS.” They warn users that “TikTok for iOS (Version 15.5.6) and TikTok for Android (Version 15.7.4) still use unencrypted HTTP to connect to the TikTok CDN.” But, as explained by the researchers, the two tech giants “ still provide a way for developers to opt-out of HTTPS for backwards-compatibility. Apple and Google want all data pushed to users’ phones to be secure.
0 kommentar(er)
