As TikTok was recovering from reports of a vulnerability that allowed anyone to take over a TikTok account with just one tap, reports have emerged over the weekend indicating that TikTok might be seeing one of the largest data breaches of the year.
It all started with a forum post on Breached.to claiming that the author named AgainstTheWest had gained access to TikTok and WeChat’s databases. The same user also tweeted claiming that they’ll release 34GB of data from TikTok’s cloud storage. The attackers said they have no idea what the data is and what it’s used for, but “it’ll be up for free”.Â
Update [06/09/22]: TikTok has refused that it was hacked. The company’s security team investigated the leak and found the leaked code in question to be completely unrelated to TikTok’s backend code, which they claim has never been merged with Wechat either. As for the leaked data, the company says that it couldn’t have originated from direct scraping of the platform as they do have enough security measures in place to prevent any scripts or bots from collecting user information.
There have been multiple guesses as to where this data might’ve originated from with a Hacker News thread suggesting that the breach might’ve originated from a third-party service that TikTok uses instead of TikTok itself.
Troy Hunt, creator of HaveIBeenPwned also looked at the leaked files and said that while some data matches production information, it could’ve been publicly available anyway.
Since then, Bob Diachenko has confirmed that the data is partially authentic and that TikTok has been breached.
In addition to claiming that the attacker has extracted over two billion records from TikTok’s database, they also claim that they have access to some of TikTok’s internal backend code, which according to the attackers, was stored on an Alibaba cloud instance with a rather insecure password.
Overall, the attackers claim to have successfully downloaded user information tables from the database amassing over 2.05 billion records coming in at around 790GB of system logs. For now, it seems like while TikTok may have patched the issue with their Android app, they’ve got another one on their hands with this data breach.
In the News; Cloudflare blocks harassment forum Kiwi Farms
