Stories
AI Uncovers Critical TikTok Flaw Exposing Phone Cameras
- •US startup DepthFirst utilized an AI system to identify a chain of vulnerabilities in open-source software used by TikTok.
- •The AI-driven research demonstrated how these flaws could be combined to remotely access a smartphone's camera and photo library while browsing TikTok.
- •DepthFirst disclosed the vulnerabilities to TikTok, which confirmed and patched the flaws before public disclosure, with no evidence of exploitation against users.
- •The incident highlights AI's growing role in cybersecurity, enabling faster vulnerability detection but also potentially lowering the barrier for malicious actors.
- •Users are reminded to keep apps updated and limit permissions to sensitive functions like cameras and photos to enhance security.
Key Questions Answered
Researchers at the US startup DepthFirst modified an AI model called GLM, developed by Chinese company Z.ai, and combined it with other tools to create a system that searches software for security weaknesses. This AI system successfully identified a chain of vulnerabilities in open-source components used by TikTok.
Yes, DepthFirst disclosed the vulnerabilities to TikTok through its security programme. TikTok confirmed the flaws and patched them before publication, stating they had no evidence the vulnerabilities were ever exploited against users.
In a controlled demonstration, researchers showed how the vulnerability chain could be combined to remotely access a smartphone's camera and photo library while browsing TikTok. This highlighted how AI can rapidly find software weaknesses, though it also raises concerns about lowering technical barriers for criminals.
