TikTok's In-App Browser Could Be Keylogging, Privacy Analysis Warns (techcrunch.com) 16
An anonymous reader shares a report: 'Beware in-app browsers' is a good rule of thumb for any privacy conscious mobile app user -- given the potential for an app to leverage its hold on user attention to snoop on what you're looking at via browser software it also controls. But eyebrows are being raised over the behavior of TikTok's in-app browser after independent privacy research by developer Felix Krause found the social network's iOS app injecting code that could enable it to monitor all keyboard inputs and taps. Aka, keylogging.
"TikTok iOS subscribes to every keystroke (text inputs) happening on third party websites rendered inside the TikTok app. This can include passwords, credit card information and other sensitive user data," warns Krause in a blog post detailing the findings. "We can't know what TikTok uses the subscription for, but from a technical perspective, this is the equivalent of installing a keylogger on third party websites." [emphasis his]
After publishing a report last week -- focused on the potential for Meta's Facebook and Instagram iOS apps to track users of their in-app browsers -- Krause followed up by launching a tool, called InAppBrowser.com, that lets mobile app users get details of code that's being injected by in-app browsers by listing JavaScript commands executed by the app as it renders the page. (NB: He warns the tool does not necessarily list all JavaScript commands executed nor can it pick up tracking an app might be doing using native code -- so at best it's offering a glimpse of potentially sketchy activities.)
"TikTok iOS subscribes to every keystroke (text inputs) happening on third party websites rendered inside the TikTok app. This can include passwords, credit card information and other sensitive user data," warns Krause in a blog post detailing the findings. "We can't know what TikTok uses the subscription for, but from a technical perspective, this is the equivalent of installing a keylogger on third party websites." [emphasis his]
After publishing a report last week -- focused on the potential for Meta's Facebook and Instagram iOS apps to track users of their in-app browsers -- Krause followed up by launching a tool, called InAppBrowser.com, that lets mobile app users get details of code that's being injected by in-app browsers by listing JavaScript commands executed by the app as it renders the page. (NB: He warns the tool does not necessarily list all JavaScript commands executed nor can it pick up tracking an app might be doing using native code -- so at best it's offering a glimpse of potentially sketchy activities.)
why is this even allowed? (Score:2)
Am I understanding this correctly that a web page can link to a page on a different domain and still have javascript from the previous page running? that sounds like a really bad thing to allow?
kind of like a cross-site scripting attack? (which mot browsers block)
Re: why is this even allowed? (Score:4, Interesting)
It's not allowed in regular browsers.
What is happening here is that the Web page is opened from within the TikTok app with a Web view screen instead of your actual browser. Since the TikTok app has full control over the Web view, it injects Javascript into every page.
Note, there are legitimate use cases to do exactly that (e.g. Hybrid apps, providing a native Web bridge, etc...).
Re: (Score:2)
Then that seems like something that the devie should pop up a notice telling the user what the app is trying to do and either allow or deny it?
Like when flashlight asks for access to your address book ;) uuuhhh.. no?
Re: (Score:3)
The simple truth is: Never put into an app what you don't want it's creators to sell to the highest bidder.
Personally, I don't
Re: (Score:2)
being a per-app thing, it should save the user's selection when they allow or deny on the first popup for the app. The user may get several popup in a row for the different things the app is trying to access, but then never again.
Re: (Score:2)
browser plugins (Score:2)
I visited InAppBrowser.com from my desktop, it detected browser plugins injecting code. Though it showed me what it found and I wasn't concerned.
Our surveillance state outsourced itself to China. (Score:2)
Re: (Score:1)
Trump was right!
Paging Oracle! ... Crickets (Score:2)
Isn't Oracle meant to be reviewing the security of TikTok? Why have they let this pass?
Or was the whole exercise always meant to be just for show?
Paranoia (Score:2)
Why would a Chinese-state controlled social media application that has 318 million downloads and requires extensive permissions on a phone, including your all-important contact list, and which is closed-source, POSSIBLY want to keylog? This is conspiracy theory five-times debunked do-not-question banned-from-Reddit tinfoil hat territory.
Re: (Score:2)
Let's face it... (Score:2)
Can't trust TikTok (Score:2)