TikTok, Fox News, New York Times, Reuters spy on clipboards In March, researchers Talal Haj Bakry and Tommy Mysk revealed that Android and iOS – including the hugely popular Chinese app TikTok – can automatically read what you copy to your mobile device clipboards.
Anything you have copied, such as sexy selfies, passwords, bank account details, can end up in the possession of third parties. This data is usually used for advertising purposes and tracking.
Covert copying of content is possible not only for local data on a device, but also on nearby devices, as long as the devices share the same Apple ID and are within about 10 meters of each other. This is enabled by Apple's unified clipboard: a clipboard that allows content to be copied on one device and then pasted into an app running on a separate device.
It's a "very dangerous case," Mysk said Friday after the discovery surfaced. The findings hit the headlines as Apple released the beta version of iOS 14 — a version that enables the feature across iPhones.
Mysk said that the ability of apps like TikTok to read content from nearby devices means that an app on an iPhone could potentially read sensitive data in the clipboards of other connected iOS devices, whether it's encryption addresses, passwords or emails, even if the apps are running on a separate device.
The beta version of iOS 14 – which you can download and install to see this feature – comes with a feature specifically tailored to highlight this process: namely, a banner warning that appears whenever an app reads contents from the clipboard.
While there are reasons for some apps to access your clipboard, the apps Mysk and Bakry found, such as TikTok, have no clear reason to do so. As Mysk said:
"These apps read clipboards and there's no reason for them to do that. An app that doesn't have fields for text input has no reason to read such text."
How many apps are monitoring your clipboards and how often? Many, and quite often, as discovered by many users who started testing the beta. A video, published on June 23 and viewed by 118,000 users as of Tuesday, June 30, shows apps being flagged by iOS 14 as they read your content.
The full list of applications
There are some big names in the list of apps that have this feature. Let's take a closer look at what they are:
Update applications
- – ABC News
- – Al Jazeera English
- – CBC News
- – CBS News
- – CNBC
- –Fox News
- – News Break
- –New York Times
- – NPR
- – ntv news
- – Reuters
- – Russia Today
- – Stern News
- – The Economist
- –The Huffington Post
- –The Wall Street Journal
- – Vice News
Games
- – 8 Ball Pool
- – AMAZING!!!
- – Bejeweled
- – Block Puzzle
- – Classic Bejeweled
- – Classic Bejeweled HD
- – FlipTheGun
- – Fruit Ninja
- – Golfmasters
- – Letter Soup
- – Love Nikki
- –My Emma
- – Plants vs Zombies Heroes
- – Pooking – Billiards City
- – PUBG Mobile
- – Tomb of the Mask
- – Tomb of the Mask: Color
- – Total Party Killer
- – Watermarbling
Social applications
- – TikTok
- – ToTalk
- – Truecaller
- – Viber
- – Zoosk
Other applications
- – 10% Happier: Meditation
- – 5-0 Radio Police Scanner
- – Accuweather
- – AliExpress Shopping App
- – Bed Bath & Beyond
- – Dazn
- – Hotels.com
- – Hotel Tonight
- – Overstock
- – Pigment – Adult Coloring Book to Color
- – Sky Ticket
- –The Weather Network
TikTok was caught red-handed
Bytedance ,the company that launched TikTok, said the problem was not their fault. Instead, they blamed an outdated Google Ads software development kit (SDK) that was about to be replaced.
But while the iOS 14 clipboard warning made it clear that the feature should be shut down, ByteDance didn’t stop the invasive practice in April as it had promised. Now, the iOS 14 uproar has caught the company “in the act,” writes Zak Doffman, as “TikTok is still doing something it shouldn’t.”
A few things to remember
All of these apps that copy clipboard content are apparently doing so secretly and have been difficult to detect. The issue highlights how important the iOS 14 update is, and Apple intends to credit the researchers who discovered this incident.
That doesn't mean your security is a given right now. Apple users will benefit from the TikTok update once it's ready to roll out to the public, but until then, keep in mind that the app reads your clipboard data
Android is a completely different matter. Mysk said things are worse on Android than on iOS, given that Android APIs are much more lax on security. For example, Android allowed apps running in the background to read the clipboard up until version 10, unlike iOS apps, which can only do so when they are active.
Be careful what you copy to your mobile device. Unfortunately, as the researchers said, we don't really know what these apps do with our content.
Source: nakedsecurity.sophos.com
