Guy Who Reverse-Engineered TikTok Reveals the Scary Things He Learned
reddit.com
reddit.com
4 days ago: https://news.ycombinator.com/item?id=23638129
> I'm getting a lot of DM's asking me to prove the majority of this with a paper and snippets of the offending code. I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. I have some frida scripts that I pushed to my git server as well as some markdown files + conversation logs I've had with exploit devs, but not much else. In order to get everyone the proof they require, I'll likely need to reverse the app all over again which isn't something I have time for right now.
Just sounds like "my dog at my homework".
And I'm just a dumb boiler-maker / welder.
It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.
Lots of people with technical clue's are also lazy as fuck about doing uninteresting work like setting up proper backups. Also somewhat paranoid about putting backups on other peoples infrastructure like dropbox (especially unencrypted).
I just wish affordable tape drives never disappeared.
I will say this: box.net's webdav support is quite useful if you want cloud storage without a client like Dropbox, OneDrive, etc. I have having a background process constantly running just so I can keep up to date files that never change, and that I either don't need locally (backups) or are too large to want multiple copies of (CD images), or get locked/constantly modified (browser profile).
Most of the stuff I produce is random garbage that isn't worth keeping. There's a good chance that this guy didn't think he had anything particularly interesting or worth keeping. Once you feel you understand how the app works, you don't really need the work you put into figuring it out anymore.
Except Dropbox has stopped supporting encrypted linux filesystems, and Box doesn't support Linux.
>It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.
For most technical people I know, having data on an unencrypted disk is unacceptable. They wouldn't accept a scenario where a thief steals their laptop and simply has access to all their files. They wouldn't accept that risk just because a convenient "backup" service suddenly stopped support. They'll simply back data up another way.
I don't know what the lay of the land is for Mac/Windows users.
As I say, these services are as useful as the services they replaced 15 years ago from my perspective.
I fail to see where in my comment was anything related to "MacOS using encrypted linux filesystems" which, as of itself as a sentence, is confusing.
My comment's parent was explaining that anything worth keeping was worth backing up, and how easy it was to set up back-up even for someone with the commenter's skill level, using services like Dropbox.
My comment was explaining that certain users who have encrypted filesystems on Linux cannot use Dropbox, for Dropbox stopped supporting them around November 2018, which makes Dropbox unusable for these users who have to come up with back-up schemes excluding Dropbox or Box.
BTW Dropbox works fine under linux, just not in all setups.
I'm a bit at a loss for words to be honest.
That's great that you have 5GB (or less) of backup-worthy data.
For anyone else like you, that's the simple and happy solution that solves the problem well enough, and you're done.
What about if you have more than 5GB? What about if you have privacy concerns? What if your offsite backup is an offline backup and you can't access it due to a pandemic restricting access and travel?
All of the above impacted me and my ability to keep my backups going, and I've had to think about how to rebuild my backup strategy, as I've lost access to the remote site where my offline backup disks are stored.
Doing small backups is easy if you just want another copy somewhere else.
Doing bigger backups on a long term sustainable basis for large amounts of data with privacy requirements is less easy.
Anyway, you deserve a cookie for having done a backup at all. You're doing better than many.
I don't know if the guy whose dog ate his homework actually did the homework.
But I know that as a system administrator/security analyst I've had to push back HARD against some really stupid the things the development team wanted to do. And I'm sure the development team thought I was stupid for requiring things like auditable artifacts, limited permissions for developers, and daily backups. They wanted to push out code as quickly and easily as possible.
Knowing tech doesn't necessarily mean adhering to the platonic ideal of 'computer best practices.' This is actually the root cause of most security breaches.
...plus, the family pictures you had on your personal laptop are probably worth a lot more than a lot of the code out there that isn't being backed up. ;)
Because the assertions being made are rather more serious?
It’s easy to misremember something, use shortcuts or assume too much when doing a hobby research project.
This is now more important than a random side project and it should be treated accordingly.
Just to make it clear, I’m not accusing anyone and I don’t suspect bad intentions; I’d just like to see as many details as possible.
They claim they weren't:
> tl;dr; I'm a nerd who figures out how apps work for a job.
Which makes the claims that he "lost the data" difficult to believe.
I checked quickly tiktok apk, but couldn't find the relevant part.
Most possibly, he is mixing some bridging functions which are mapping functions or resources from dex files. (such as https://github.com/alibaba/ARouter, which I suspect tiktok uses)
such as:
@Route(path = "/test/activity") public class YourActivity extend Activity { ... }
https://github.com/termux/termux-packages/wiki/Termux-and-An...
Also what you suggested is not symmetric, let me explain:
- There is a claim tiktok is downloading some zip file, extracting and executing.
making this claim is almost free, for me to claim otherwise, requires to reverse engineer all the app, then check 100s of possibilities to execute code in android app.
For example I took a quick look, and couldn't find anything related to this claim.
Also I checked reports from some "security" companies, there is nothing concrete there too. Mostly they talk about some SDK from appsflyer, which is used by a lot of apps, getting a lot of data, including IMSI etc (which is a US company btw)
But if you still ask me if it is running downloaded code, I cannot say 100% certain "no".
I believe claims should need proof, not the other way around.
The "private data" the app collected, is used, for most part, fingerprint the unique user.
In every MCN app, there was a huge fake user problem. If an app collect zero identifiable fingerprint, then a spammer can easily fake millions of views and manipulate ranked content. The app developers are asked think clever to collect every piece of info they can, while spammers spent night and days spoof every parameter in a virtual machine or even on a matrix of remote controlled real phones.
For example, if a iPhone 11 user logs in, but only with screen resolution of 320x240, is it legit? I have caught tens of thousands of fake users with simple checks like this. However the tricks expires pretty quickly, you have to move on with new feature checks, together with decision trees and bayesian networks.
Some of the fingerprint collecting SDKs are even using native code to check some ARM specific instructions to tell if the device is fake or not. The parameters check had to be done in every important API calls, or spammers can easily pretend be good citizen during parameter checking process and swap the session to a cheaper VM/phone or spam the targeted API with scripts.
Chinese companies all have their own team dealing with frauds or spamming on daily basis, the same way as everything can be faked in China.
Think cyber attacks from Chinese IPs are bad? Now imagine doing business in China and all users of your product are bots, what methods do you have to filter out the real human users? Good luck.
Many ads network SDKs are collecting user data in the same way. Otherwise it's easy to spoof fake clicks and page views.
I not stating if it's the right or wrong thing to do, I am just saying it's how things are done in current state of business.
Yes, ads SDK across different apps can provide detailed aggregated information. Also apps promote each other, the "channel distribution" is huge business and relies on apps acknowledge each other.
I highly doubt many of the Tiktok reverse-engineering result may turn out to be some thirdparty ads or anti-fraud SDKs which Chinese companies use often.
https://support.google.com/youtube/answer/2737059?hl=en
It's an established term to describe org affiliated with youtube/twitch/tiktok/instagram etc.
For some of these operations, you can just work off of the content. Spam messages need to advertise something, so the text needs to look very different than for legit posts.
But something like an upvote or like? It's a single bit of information, you can't say if it's legit or fraudulent in isolation. So then you need to come up with additional signals to cluster on from wherever you can.
Some of it will be behavioural (these 10k users only liked these spammy videos), but a lot of it has to be environmental.
Had to OCR all those god damn avatars.
If visibility on your platform is somewhat commercially relevant, then you will have lots of people pushing fake accounts for various goals. And if you ignore them, then the more technically competent ones will set up offers to sell access to fake accounts on your platform, so that they will be abused also by actors who don't have the ability to create thousands of fake accounts on their own.
This picture explains
Chinese can recycle real iPhone/Android devices at minimal cost. Anyone can rent a fleet of real devices, then RCE software can execute any kind of task you want on a real app on a real phone. So even Apple or Google provide some kind of unique id, e.g. iOS already have something like identifierForVendor, the spammers emulate a real user's app download, registration, login process, thus obtaining a real ID. So what can you do about the ID?
So the obvious solution is to check for more user information beyond a simple ID. Your IP, mac address, wifi router address, other process the OS is running, device parameters, etc. and privacy is f??ked in the process.
PS. Someone correct me if I'm wrong.
A lot of videos and articles make me feels more like pure anti-China sentiments, just like many similar campaigns did to Huawei last year.
It's fine call out the risk in terms of personal privacy, or national security.
It's also fine to have and express anti-China sentiments, since everyone has his/her own opinions.
But it annoys me there are a lot of people charging with only assumptions, or play double standards just to make every Chinese business or Chinese person looks evil. It's just hypocritical.
Similar things have been said about Facebook for ages, but it's beating a dead horse now. We all know Facebook collects everything.
There was a huge shift in reddit's demeanor (and uses of "fuck China/fuck the CPC" etc) once the Hong Kong protests got going. COVID-19 (and its associated conspiracy theories) seems to be what brought that sentiment more mainstream.
Any user with a password manager has probably disclosed that to them.
And what exactly would they want with arbitrary passwords anyway? Using them would basically destroy their business as soon as anyone figured it out, and selling them would not remotely be worth the risk.
Telling people that TikTok is doing some shady stuff doesn't mean other companies are better. It's not a competition to see which company is good and which is bad. Every company that employs user tracking should be highlighted and asked to stop, and users should be informed about what the company is doing, no matter where the company is based.
If it could be proven that every social media app is covertly tracking users that would not mean TikTok is good. It would mean every social media app is bad.
In this case we have a random reddit shitposter calling himself an expert, making wild accusations.
It's not about "which company is better", it's about holding them up to the same standards.
Bein critical toward something which potential aims for your soul is legit IMHO.
All these claims I see sound like EVERY SINGLE APP could be doing the same thing. Are both iOS/Android really that exposed that they can just get all of this info without explicitly asking for permission? If they are bypassing shit and recording your mic under the radar.. how the hell would apple/google be letting a billion user+ app be doing this?
Something just doesn't pass the smell test here.
It wouldn’t be the first time — see NSO group and its many exploits. Here TikTok makes it even easier!
I'd assume apps like fb/twitter/snapchat/etc scrape just as much. And since the US gov basically forces them to install backdoors, isn't that worse than this whole TikTok privacy conversation? Maybe I'm missing something though.
The author claims otherwise:
“For what it's worth I've reversed the Instagram, Facebook, Reddit, and Twitter apps. They don't collect anywhere near the same amount of data that TikTok does, and they sure as hell aren't outright trying to hide exactly whats being sent like TikTok is. It's like comparing a cup of water to the ocean - they just don't compare.”
Also, the video is unavailable on youtube.
https://www.reddit.com/r/videos/comments/fxgi06/not_new_news...
Isn't it an excellent sample of "the cat ate my code" excuse?
I think i read that exact sentence here on HN, oh and my Dog eat all the proofs. No need to do it again ;)
It doesn't make their activities right, of course. But it's debatable whether legally speaking, they are in violation of privacy laws.
I think they have a higher chance of violating EU privacy laws than US ones. GDPR is quite strict: you need to have a good reason for doing something, not merely mentioning that you'll do something.
I think it's also interesting to know that Tiktok's servers are in Singapore.
Look at how good russian spies were at infiltrating the gov't : https://en.wikipedia.org/wiki/Cambridge_Five , and tell me that china couldn't do the same or better.
You're probably right, they might have some sketchy way, but if you really wanted to see who is doing what with your data from within your data center you could really set controls to do so.
The USA is just much better at pretending everything it does is rightful.
I mean, "a history of suppressing minorities" in the summer of 2020 is very funny. It does feel like Gen Z kids are aware of global events enough to not fall for this, so maybe it is ending.
China on the other hand, screams everyday how it wants to own taiwan. Aggressively threatens any country who dares to touch the south china seas, which it does not own.
Yes, your boss is not allowed to talk to you about national security letters, unless your specific involvement is needed.
I as an outsider can't tell and have to trust. For that I have to evaluate how important your site as a target for such measures is, how likely I am the target and how likely my data is just close to a Target's data and how much of it will be in a full data grab for later usage.
Judges to the FISC are appointed by the Chief Justice without any further oversight and the Chief Justice is politically appointed as well. (A democratic process for nominating judges isn't easy,. but vesting the power into a single hand is questionable)
Also the low number of modified or rejected warrants is suspicious (the positive interpretation might be that warrants are well prepared and thus qualify)
For me as an foreigner to both cases, both approaches are problematic and I have no democratic influence over either process. And yeah, I trust US more to be aligned with my interests, but neither is a happy thing for me.
> The problem here is Facebook, Instagram and Twitter are US based companies that are beholden to the government. While sure you have lobbying going on, they are ultimately separate from the government, and if are found in violation of certain laws will be prosecuted or at least brought in front of congress and can face stiff penalties in the US. TikTok IS the Chinese government. They are beholden to no one. They can't break the law since they are the law.
Well, he almost has it figured out. We are all actually beholden to our governments. Even Apple allegedly held off on iCloud encryption because of FBI pressure, not to mention constant right-wing efforts to destroy encryption and force companies to insert backdoors. China has a stronger central authority (therefore easier to force companies to do things), but the US is itching to go that route as well. Fighting it means preserving an actual ideological backbone, rather than simply consolidate all power to destroy our enemies.
If we lose our sights on encryption, separation of our corporate entities from our government, then we are just China but in a different location.