TikTok denies recent allegations about a breach of its platform and the theft of source code and user data.
A few days ago, data purportedly belonging to TikTok was posted on a hacking forum, but the Chinese company ByteDance, which owns TikTok, said that this data was “completely unrelated” to the company.
Behind this data leak is a hacking group known as “AgainstTheWest,” which on Friday created a new thread on a hacking forum and claimed to have data from both TikTok and WeChat. The group shared screenshots of an alleged database belonging to the companies that contained user data.
The hackers said they have at their disposal a massive database 790 GB containing user data, platform statistics, software code, cookies, auth tokens, server information, and more.
See also: TikTok's in-app browser tracks your every move
While the name AgainstTheWest may sound like the hacking group is targeting Western countries, in reality the hackers claim they only target countries and companies hostile to Western interests.
“Don’t let the name confuse you, ATW targets countries it deems a threat to Western society, currently targeting China and Russia and has plans to target North Korea, Belarus and Iran in the future,” explains cybersecurity researcher CyberKnow.
TikTok denies allegations of hacking and data theft
TikTok told BleepingComputer that the claims being hacked are untrue. Additionally, the company said that the source code leaked on the hacking forum is not part of its platform.
“This is an incorrect claim — our security team investigated this statement and found that the code in question is not related to TikTok’s backend source code at all, which has never been merged with WeChat data,” Twitter said.
The popular app also emphasized that the leaked user data could not have been easily stolen from the platform, as the company has adequate security that prevent automated scripts from collecting user information.
It is worth noting that WeChat and TikTok are two Chinese apps, not owned by the same parent company. WeChat is owned by Tencent and TikTok by ByteDance. Therefore, the appearance of both in a single database indicates that it was not a direct infringement on each platform (TikTok and WeChat).
Most likely, the unprotected database was created by a third-party data scraper or broker who collected public data from both services and stored it in a single database.
See also: Zero-day flaw in Google Chrome: Update immediately
The two companies are constantly at the center of investigations by national agencies, so finding a database containing data from both companies raises suspicions.
Troy Hunt, the creator of the data breach notification service HaveIBeenPwned, confirmed in a Twitter thread that some of the data was valid. However, Hunt found data that is publicly available on TikTok.
However, the expert notes that the database does contain some internal platform information. This information is not exactly useful, but if true, it means that there is a security breach on TikTok.
Similarly, “database hunter” Bob Diachenko has validated the leaked user data as real, but was unable to provide specific conclusions about the origin of the data.
If further analysis reveals that the data is legitimate, TikTok will be forced to take steps to mitigate the effects of the leak, even if it was not breached.
It is worth noting, however, that just a few days earlier, Microsoft said it had found a serious vulnerability in the Android version of TikTok, “which would allow attackers to compromise users’ accounts with a single click.”
Learn more: TikTok Android: Vulnerability allowed accounts to be compromised
A TikTok spokesperson said the company responded quickly to Microsoft's findings and fixed the security, which was identified "in certain older versions of the Android app."
Source: www.bleepingcomputer.com
