MANILA, Philippines – TikTok said its security team is working to fix an exploit that allowed attackers to potentially hijack accounts via a malicious direct message to said accounts.
BleepingComputer’s report called the exploit a zero-day vulnerability, or a security flaw that had no patches or published information at the time of an attack detailing what the underlying weakness was.
The attacks on high-profile accounts were first reported by Semafor and Forbes, with user accounts belonging to CNN, Paris Hilton, and Sony being affected. The accounts were temporarily taken down to prevent abuse by attackers.
In a statement, TikTok spokesperson Alex Haurek said, “Our security team is aware of a potential exploit targeting a number of brand and celebrity accounts. We have taken measures to stop this attack and prevent it from happening in the future. We’re working directly with affected account owners to restore access, if needed.”
A TechCrunch report added TikTok did not discuss the particulars of how the attack worked to prevent tipping off other bad actors, and has not yet said how many accounts or users were affected by the exploit. – Rappler.com