Popular short-form social video service TikTok denied reports
that it was breached by a hacking group, after it claimed to have
gained access to an insecure cloud server.
“TikTok prioritizes the privacy and security of our users’
data,” the ByteDance-owned company told The Hacker News. “Our
security team investigated these claims and found no evidence of a
security breach.”
The denial follows alleged reports of a hack that surfaced on
the Breach Forums message board on September 3, with the threat
actor noting that the server holds 2.05 billion records in a
humongous 790GB database.
“Who would have thought that TikTok would decide to store all
their internal backend source code on one Alibaba Cloud instance
using a trashy password?,” the hacking group known as BlueHornet
(aka AgainstTheWest[1]) tweeted[2]
over the weekend.
Bob Diachenko, threat intelligence researcher at Security
Discovery, said[3]
the breach is “real” and that the data is likely to have originated
from “Hangzhou Julun Network Technology Co., Ltd rather than
TikTok.”
That said, it’s far from clear at the moment where exactly the
data has come from and whether third-parties have access to this
kind of information.
“This is so far pretty inconclusive; some data matches
production info, albeit publicly accessible info,” security
researcher Troy Hunt said[4]
in a tweet. “Some data is junk, but it could be non-production or
test data. It’s a bit of a mixed bag so far.”
The development comes at an inopportune time, as the company
continues[5]
to face mounting scrutiny for its data security practices owing to
its links to China.
Update: In a follow-up statement
shared with The Hacker News, the social media company reiterated
its security team found no evidence of a security breach.
“We have confirmed that the data samples in question are all
publicly accessible and are not due to any compromise of TikTok
systems, networks, or databases,” a TikTok spokesperson said.
“The samples also appear to contain data from one or more
third-party sources not affiliated with TikTok. We do not believe
users need to take any proactive actions, and we remain committed
to the safety and security of our global community.”
Additionally, the Twitter account of AgainstTheWest has since
been suspended and allegations of the break-in have since been
modified on Breach Forums to mention that “the breach is not from
TikTok, and that he most likely was lying or didn’t even
investigate it before making such outrageous claims.”
“AgainstTheWest has had a long history of lying about breaches
or other things (saying he’s a state-sponsored hacking group…
LOL) and this was just the tipping point,” pompompurin, the actor
who launched
Breach Forums[6]
earlier this March, said.
References
Read more https://thehackernews.com/2022/09/tiktok-denies-data-breach-reportedly.html