Security Researchers Take Advantage of Insecure HTTP to Display Fake Videos on TikTok

An investigation by Talal Haj Bakry and Tommy Mysk has revealed that backwards-compatible support for HTTP in iOS and Android is allowing data from popular apps such as TikTok to be intercepted and altered.

tiktok logo
While most apps have made the transition to HTTPS, the research discovered that TikTok on iOS and Android still uses unencrypted HTTP to download media content. Consequently, TikTok inherits all of the known and well-documented HTTP vulnerabilities.

Apple introduced App Transport Security in iOS 9, requiring all HTTP connections to use encrypted HTTPS. Google similarly changed the default network security configuration in Android Pie to block all plaintext HTTP traffic. HTTP vulnerabilities still exist, however, since Apple and Google continue provide a way for developers to opt-out of HTTPS for backwards-compatibility.


The investigation proved that it is possible to successfully intercept TikTok traffic and fool the app to show fake videos as if they were published by popular and verified accounts. Any router between the TikTok app and TikTok's servers can easily expose a user's watch history, and change profile photos and videos. While only users connected to the router will see the malicious content, the research suggests that if a popular DNS server was hacked to include a corrupt DNS record, media data could be changed on a large scale.

Popular Stories

iPhone Top Left Hole Punch Face ID Feature Purple

10 Reasons to Wait for This Year's iPhone 18 Pro

Thursday January 8, 2026 2:56 am PST by
Apple's iPhone development roadmap runs several years into the future and the company is continually working with suppliers on several successive iPhone models at the same time, which is why we often get rumored features months ahead of launch. The iPhone 18 series is no different, and we already have a good idea of what to expect for the iPhone 18 Pro and iPhone 18 Pro Max. One thing worth...
samsung crease less foldable display ces 2026%402x

Foldable iPhone's Crease-Free Display Tech Spotted at CES 2026

Tuesday January 6, 2026 3:04 am PST by
CES 2026 has just provided a first glimpse of the folding display technology that Apple is expected to use in its upcoming foldable iPhone. At the event, Samsung Display briefly showcased its new crease-less foldable OLED panel beside a Galaxy Z Fold 7, and according to SamMobile, which saw the test booth before it was abruptly removed, the new panel "has no crease at all" in comparison. The ...
iOS 27 Mock Quick

Five New iPhone Features Rumored for iOS 27

Wednesday January 7, 2026 2:51 pm PST by
Though it's been just a few months since iOS 26 launched, we're already hearing rumors about the next-generation version of iOS, iOS 27. iOS 27 will be introduced at Apple's June WWDC 2026 event before it launches in September 2026. We don't know all of the details about iOS 27 yet, but we do have some information about what to expect. "Snow Leopard" Update iOS 27 will apparently focus...
Apple Card iPhone 16 Pro Feature

Apple Card Will Move From Goldman Sachs to JPMorgan Chase

Wednesday January 7, 2026 12:57 pm PST by
JPMorgan Chase has reached a deal to take over operation of the Apple Card, reports The Wall Street Journal. Barring any "last minute hiccups," the deal should be announced shortly after over a year of negotiations. Reports began circulating over two years ago that current Apple Card issuer Goldman Sachs was looking to end its partnership with Apple as part of an effort to scale back on...
Logitech MX Master 3S

Logitech Blames 'Inexcusable Mistake' After Certificate Expiry Breaks macOS Apps

Wednesday January 7, 2026 5:27 am PST by
Logitech users on macOS found themselves locked out of their mouse customizations yesterday after the company let a security certificate expire, breaking both its Logi Options+ and G HUB configuration apps. Logitech devices like its MX Master series mice and MX Keys keyboards stopped working properly as a result of the oversight, with users unable to access their custom scrolling setup,...
ChatGPT Health Integration Connectors Feature

OpenAI Launches ChatGPT Health With Apple Health Integration

Wednesday January 7, 2026 11:27 am PST by
OpenAI today announced the launch of ChatGPT Health, a dedicated section of ChatGPT where users can ask health-related questions completely separated from their main ChatGPT experience. For more personalized responses, users can connect various health data services such as Apple Health, Function, MyFitnessPal, Weight Watchers, AllTrails, Instacart, and Peloton. Last month, MacRumors discovere...
Touchscreen MacBook Feature

Apple Is Expected to Launch These Four MacBooks in 2026

Friday January 9, 2026 8:17 am PST by
2026 could be a bumper year for Apple's Mac lineup, with the company expected to announce as many as four separate MacBook launches. Rumors suggest Apple will court both ends of the consumer spectrum, with more affordable options for students and feature-rich premium lines for users that seek the highest specifications from a laptop. Below is a breakdown of what we're expecting over the next ...
safari icon blue banner

Apple Loses Safari Lead Designer to The Browser Company

Thursday January 8, 2026 10:50 am PST by
Apple has lost another senior figure from its Safari team as a lead designer departs for The Browser Company, extending a pattern of high-profile exits from Apple's browser team amid intensifying competition around AI-driven browsing. Marco Triverio was a lead designer for Safari and has now joined The Browser Company, the developer of the Arc and Dia browsers. The move was confirmed by The...

Top Rated Comments

patent10021 Avatar
75 months ago
The Leslie Nielsen of security researchers.

The Chinese apps have insecure HTTP because the government needs back-doors. I know first hand.
Score: 9 Votes (Like | Disagree)
Puppuccino Avatar
75 months ago
I’ve never downloaded TikTok, I’m not touching that app. Goodness knows what tracking it’s doing.
Score: 8 Votes (Like | Disagree)
phenste Avatar
75 months ago
Oops.
Having seen Vine come and go in what felt like an instant (while I was in high school), the fact that TikTok isn’t dead yet is a MARVEL to me. Especially with how clearly unsafe it is, and how clearly stupid all the teenage influencers on it are.

Vine was the genesis of Jake/Logan Paul, and the most we got out of that was a horribly-poor-taste YouTube video with a hanged corpse in the icon, and Post Malone’s house getting accidentally doxxed. (Yes, Jake Paul is stupid enough to accidentally dox someone.)

With TikTok, I feel like we could get the Chinese government somehow getting into the accounts of EVERY influencer, and every person that follows these influencers, and just…****ing something up majorly. I don’t know what, but if there’s anything I’ve learned in the last few months, it’s that you never know what’s around the corner.
Score: 6 Votes (Like | Disagree)
lkrupp Avatar
75 months ago

Here's the real problem. I recently submitted an app and when you want to opt-out, you have to give a very good reason. Privacy-first Apple should have ended backwards-compatibility years ago. For any serious developer, there is no good reason not to use HTTPS, simple SSL certificates (which are fine for encryption) have always been cheap and now they're even free with Let's Encrypt.
There’s no good reason not to use HTTPS just like there’s no good reason to use Flash... but developers and users DO continue to use them and scream bloody murder when things no longer work. macOS still supports Flash even though it’s a pos. And when something doesn’t work on their Apple gear it’s automatically Apple’s fault no matter what. Just look at all the rage at the 32/64 bit change and APFS. If Apple were to stop supporting HTTP many websites would go dead on the platform. It’s a catch-22.
Score: 4 Votes (Like | Disagree)
mi7chy Avatar
75 months ago
Intercept crappy videos with even crappier ones?
Score: 3 Votes (Like | Disagree)
AlexGraphicD Avatar
75 months ago
LMAO How can people be so clueless and download these kind of spyware in the first place? How can a Chinese social media app become so popular out of the confined borders of that communist regime in this day and age is beyond ridiculous.
Score: 3 Votes (Like | Disagree)