New TikTok Zero-Day Vulnerability Discovered

June 6, 2024

Topics

zero-day
vulnerability
TikTok

Over the past couple of years, multiple new social media applications have been created and begun to gain a mass following. Some of the most recent applications that have been developed include Instagram Threads, Dispo, and Kick. However, one of the most popular yet controversial social media applications of the past 10 years has been none other than TikTok. TikTok is a video-sharing platform that rose to fame in the United States right before the pandemic. Earlier this week, TikTok confirmed that the platform fell victim to a zero-day vulnerability.

Introduction

What is a Zero-Day Vulnerability?:

Zero-day vulnerabilities are flaws and bugs within the software or hardware of a system that are currently not known to the vendor. The naming convention for this type of attack is derived from the fact that the developers and engineers of the company have “zero” days to fix this vulnerability since they are unaware of it. Malicious actors take advantage of these vulnerabilities and try to exploit them. When a zero-day vulnerability is exploited, it becomes a zero-day exploit or zero-day attack.

TikTok Direct Messaging Zero-Day Vulnerability:

On June 5th, TikTok acknowledged that it had fallen victim to a zero-day exploit. The exploit, which was first discovered by news outlets, Semafor and Forbes, affects the platform's direct messaging functionality. Currently, the exact vulnerability within the direct messaging system has not been disclosed. In the report by Forbes, they mentioned that the vulnerability allows hackers to spread malware through direct messages without needing any input from the user. Once the malware is sent to the victim via direct messaging, if the user opens the chat to view the message that is all that is needed for the attack to carry through. There is no input such as a reply or clicking on a link required.

At this time, there is a lot of information that is currently unknown or being withheld from the public. Items like what strand of malware and the hacker group responsible for this exploit are still unknown. What is known is that this attack only targeted celebrity profiles and accounts of large brands. Some accounts that have been identified to be affected by this hack belonged to Paris Hilton, CNN, and Sony. TikTok has already implemented measures to address this vulnerability and is working with the affected users to restore their accounts.

How to Protect Against Zero-Day Vulnerabilities:

Protecting against zero-day vulnerabilities is not an easy task because as its name implies, these vulnerabilities are not known beforehand. This makes it tricky because how can you protect against something that you don’t know even exists. Although you can’t specifically prevent a zero-day vulnerability, there are actions you can take to reduce the likelihood of being affected by these attacks. Probably the most important step that can be taken is staying up-to-date on patches. This ensures that software, operating systems, and applications are updated with the latest security patches. This reduces the attack surface for a hacker to try and exploit. Network segmentation is another step that can be taken to reduce the attack surface. Segmentation of the network protects the organization from the attack reaching potentially more critical and vulnerable. Another thing that is often overlooked, is just staying updated with the latest security trends and cybersecurity news. By following these steps you can help better protect the organization from these attacks.

Conclusion

The most recent cyberattack on the popular social media platform, TikTok, shows just how advanced hackers have become in the past couple of years. As threat actors become more skilled and develop new strains of malware it is even more so important that we do all we can to keep our systems secure. In the case of zero-day vulnerabilities, it is a tricky situation because no one is aware the vulnerability exists until the systems are tested or a hacker exploits it. That being said, although we may not know a vulnerability exists, we can do our part and take measures to reduce the chances of a hack having major impacts on the business. In the coming months, it will be interesting to see how other social media platforms will respond to this cyber incident and what measures they implement in their systems to prevent a hack like this. This was not the first time a popular social media platform has been hacked, and it most likely will not be the last.

New TikTok Zero-Day Vulnerability Discovered

Introduction

What is a Zero-Day Vulnerability?:

TikTok Direct Messaging Zero-Day Vulnerability:

How to Protect Against Zero-Day Vulnerabilities:

Conclusion

Sources

Up Next

Raptor Train - IoT Botnet

MOVEit Transfer Exploitation